A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade samba | Jul 30, 2024 | Apr 9, 2019 |
| Oracle Solaris | — | Upgrade library/samba/libsmbclient to version 4.9.6-11.4.11.0.1.1.0 on Solaris 11.4Upgrade service/network/samba to version 4.9.6-11.4.11.0.1.1.0 on Solaris 11.4 | Jul 17, 2019 | Apr 9, 2019 |
| Samba | — | Upgrade to Samba version 4.9.6Upgrade to Samba version 4.10.2 | Apr 30, 2019 | Apr 9, 2019 |
| Suse | — | Upgrade libtevent-util-develUpgrade libdcerpc0-32bitUpgrade libsamdb0Upgrade libsamba-util0-32bitUpgrade libsmbconf0Upgrade libnetapi0Upgrade libndr1Upgrade libsamba-util0Upgrade libndr-nbt-develUpgrade libsamba-hostconfig0Upgrade libsamba-util-develUpgrade libsamba-hostconfig0-32bitUpgrade libsmbldap2-32bitUpgrade samba-winbindUpgrade libdcerpc-binding0Upgrade libsamba-errors0Upgrade samba-docUpgrade libsamba-passdb0-32bitUpgrade libsmbldap-develUpgrade libsmbldap2Upgrade samba-libs-python3Upgrade ctdbUpgrade libdcerpc-develUpgrade libndr0Upgrade libsamba-errors0-32bitUpgrade libndr-nbt0Upgrade samba-winbind-32bitUpgrade libsmbclient0-32bitUpgrade libtevent-util0Upgrade sambaUpgrade libwbclient-develUpgrade libndr-standard0-32bitUpgrade libsamba-policy-develUpgrade libsmbconf0-32bitUpgrade samba-libsUpgrade libtevent-util0-32bitUpgrade libnetapi-develUpgrade libsamba-policy0-python3Upgrade samba-libs-32bitUpgrade libndr-krb5pac0-32bitUpgrade libsamba-credentials-develUpgrade libwbclient0Upgrade samba-cephUpgrade libsmbclient-develUpgrade samba-core-develUpgrade samba-clientUpgrade libndr0-32bitUpgrade libnetapi0-32bitUpgrade libsamba-hostconfig-develUpgrade samba-libs-python3-32bitUpgrade libsamdb0-32bitUpgrade libsamdb-develUpgrade libdcerpc0Upgrade libdcerpc-binding0-32bitUpgrade libsmbconf-develUpgrade libndr-develUpgrade libsamba-passdb0Upgrade libsamba-passdb-develUpgrade samba-dsdb-modulesUpgrade libsamba-credentials0-32bitUpgrade libndr-standard-develUpgrade libndr-nbt0-32bitUpgrade libndr-krb5pac-develUpgrade libsamba-policy-python3-develUpgrade libdcerpc-samr0Upgrade libsamba-credentials0Upgrade samba-python3Upgrade libndr1-32bitUpgrade libndr-krb5pac0Upgrade libwbclient0-32bitUpgrade libndr-standard0Upgrade samba-client-32bitUpgrade libdcerpc-samr-develUpgrade libsmbclient0Upgrade libsamba-errors-devel | Dec 19, 2019 | Apr 9, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub