CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 0CVE-2019-3880 – samba: save registry file outside share as unprivileged user
https://notcve.org/view.php?id=CVE-2019-3880
A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable. Se encontró un fallo en la forma en que samba implementó RPC endpoint, que emula la API de servicios de registro de Windows. Un atacante sin privilegios podría usar este defecto para crear un nuevo archivo de registro hive en cualquier lugar que tenga permisos Unix, lo que podría llevar a la creación de un nuevo archivo en el recurso compartido de Samba. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00106.html https://access.redhat.com/errata/RHSA-2019:1966 https://access.redhat.com/errata/RHSA-2019:1967 https://access.redhat.com/errata/RHSA-2019:2099 https://access.redhat.com/errata/RHSA-2019:3582 https://access.redhat.com/security/cve/cve-2019-3880 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3880 https://lists.debian.org/d • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-3824
https://notcve.org/view.php?id=CVE-2019-3824
A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service. Se ha detectado un fallo en la manera en la que una expresión de búsqueda LDAP podría provocar el cierre inesperado del proceso del servidor LDAP de un AD DC de samba en samba en versiones anteriores a la 4.10. Un usuario autenticado con permisos de lectura en el servidor LDAP podría aprovechar este fallo para provocar una denegación de servicio (DoS). • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00035.html http://www.securityfocus.com/bid/107347 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3824 https://bugzilla.samba.org/show_bug.cgi?id=13773 https://lists.debian.org/debian-lts-announce/2019/03/msg00000.html https://security.netapp.com/advisory/ntap-20190226-0001 https://usn.ubuntu.com/3895-1 https://www.debian.org/security/2019/dsa-4397 • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 4%CPEs: 3EXPL: 0CVE-2018-16853
https://notcve.org/view.php?id=CVE-2018-16853
Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command. Samba, desde la versión 4.7.0, tiene una vulnerabilidad que permite que un usuario en el dominio Samba AD provoque el cierre inesperado del KDC cuando Samba se incluye en la configuración de MIT Kerberos que no es la predeterminada. • http://www.securityfocus.com/bid/106026 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16853 https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://www.samba.org/samba/security/CVE-2018-16853.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16857
https://notcve.org/view.php?id=CVE-2018-16857
Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade. Samba, desde la versión 4.9.0 y antes de la versión 4.9.3, con las configuraciones AD DC buscando malas contraseñas (para restringir la adivinación de contraseñas por fuerza bruta) durante más de 3 minutos podría no buscar malas contraseñas en absoluto. El riesgo principal de este problema está relacionado con los dominios que se han actualizado desde Samba 4.8 y anteriores. • http://www.securityfocus.com/bid/106024 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16857 https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://www.samba.org/samba/security/CVE-2018-16857.html • CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16852
https://notcve.org/view.php?id=CVE-2018-16852
Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue, merely a denial of service. Samba, desde la versión 4.9.0 antes de la versión 4.9.3, es vulnerable a una desreferencia de puntero NULL. Durante el procesamiento de una zona DNS en el servidor DCE/RPC de gestión DNS, el servidor DNS interno del plugin Samba DLZ para BIND9, si las propiedades DSPROPERTY_ZONE_MASTER_SERVERS o DSPROPERTY_ZONE_SCAVENGING_SERVERS están establecidas, el servidor seguirá un puntero NULL y se terminará. • http://www.securityfocus.com/bid/106024 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16852 https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://www.samba.org/samba/security/CVE-2018-16852.html • CWE-476: NULL Pointer Dereference •