Samba up to 4.9.5/4.10.1 AD DC permission

Summaryinfo

A vulnerability identified as critical has been detected in Samba up to 4.9.5/4.10.1. The impacted element is an unknown function of the component AD DC. This manipulation causes permission. This vulnerability is handled as CVE-2019-3870. It is possible to launch the attack on the local host. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Samba up to 4.9.5/4.10.1 (File Transfer Software). It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component AD DC. The manipulation with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

The bug was discovered 04/08/2019. The weakness was released 04/09/2019 as confirmed bug report (Bugzilla). The advisory is shared at bugzilla.redhat.com. This vulnerability is known as CVE-2019-3870 since 01/03/2019. An attack has to be approached locally. A single authentication is required for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 296034 (Azure Linux 3.0 Security Update: samba (CVE-2019-3870)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 277799 (Fedora Security Update for samba (FEDORA-2019-db21b5f1d2)).

Upgrading to version 4.9.6 or 4.10.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (296034). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• File Transfer Software

Name

• Samba

Version

• 4.9.0
• 4.9.1
• 4.9.2
• 4.9.3
• 4.9.4
• 4.9.5
• 4.10.0
• 4.10.1

License

• open-source

Website

• Product: https://www.samba.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion