Page 11 of 61 results (0.026 seconds)

CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 0

CVE-2019-3880 – samba: save registry file outside share as unprivileged user

https://notcve.org/view.php?id=CVE-2019-3880

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable. Se encontró un fallo en la forma en que samba implementó RPC endpoint, que emula la API de servicios de registro de Windows. Un atacante sin privilegios podría usar este defecto para crear un nuevo archivo de registro hive en cualquier lugar que tenga permisos Unix, lo que podría llevar a la creación de un nuevo archivo en el recurso compartido de Samba. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00106.html https://access.redhat.com/errata/RHSA-2019:1966 https://access.redhat.com/errata/RHSA-2019:1967 https://access.redhat.com/errata/RHSA-2019:2099 https://access.redhat.com/errata/RHSA-2019:3582 https://access.redhat.com/security/cve/cve-2019-3880 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3880 https://lists.debian.org/d • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0

CVE-2019-3824

https://notcve.org/view.php?id=CVE-2019-3824

A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service. Se ha detectado un fallo en la manera en la que una expresión de búsqueda LDAP podría provocar el cierre inesperado del proceso del servidor LDAP de un AD DC de samba en samba en versiones anteriores a la 4.10. Un usuario autenticado con permisos de lectura en el servidor LDAP podría aprovechar este fallo para provocar una denegación de servicio (DoS). • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00035.html http://www.securityfocus.com/bid/107347 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3824 https://bugzilla.samba.org/show_bug.cgi?id=13773 https://lists.debian.org/debian-lts-announce/2019/03/msg00000.html https://security.netapp.com/advisory/ntap-20190226-0001 https://usn.ubuntu.com/3895-1 https://www.debian.org/security/2019/dsa-4397 • CWE-125: Out-of-bounds Read •

CVSS: 7.5EPSS: 4%CPEs: 3EXPL: 0

CVE-2018-16853

https://notcve.org/view.php?id=CVE-2018-16853

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command. Samba, desde la versión 4.7.0, tiene una vulnerabilidad que permite que un usuario en el dominio Samba AD provoque el cierre inesperado del KDC cuando Samba se incluye en la configuración de MIT Kerberos que no es la predeterminada. • http://www.securityfocus.com/bid/106026 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16853 https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://www.samba.org/samba/security/CVE-2018-16853.html • CWE-400: Uncontrolled Resource Consumption •

CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0

CVE-2018-16841

https://notcve.org/view.php?id=CVE-2018-16841

Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process. Samba, desde la versión 4.3.0 antes de las versiones 4.7.12, 4.8.7 y 4.9.3, es vulnerable a una denegación de servicio (DoS). Cuando se configura para aceptar la autenticación por smartcard, el KDC de Samba llamará a talloc_free() dos veces en la misma memoria si la entidad de seguridad en un certificado firmado de forma válida no coincide con la entidad en AS-REQ. • http://www.securityfocus.com/bid/106023 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16841 https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://usn.ubuntu.com/3827-1 https://usn.ubuntu.com/3827-2 https://www.debian.org/security/2018/dsa-4345 https://www.samba.org/samba/security/CVE-2018-16841.html • CWE-415: Double Free CWE-416: Use After Free •

CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0

CVE-2018-16851

https://notcve.org/view.php?id=CVE-2018-16851

Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service. Samba, desde la versión 4.0.0 antes de las versiones 4.7.12, 4.8.7 y 4.9.3, es vulnerable a una denegación de servicio (DoS). • http://www.securityfocus.com/bid/106027 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16851 https://lists.debian.org/debian-lts-announce/2018/12/msg00005.html https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://usn.ubuntu.com/3827-1 https://usn.ubuntu.com/3827-2 https://www.debian.org/security/2018/dsa-4345 https://www.samba.org/samba/security/CVE-2018-16851.html • CWE-476: NULL Pointer Dereference •