Vulnerability identifier: #VU18149
Vulnerability risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-61
Exploitation vector: Local network
Exploit availability: No
Vulnerable software:
Samba
Server applications /
Directory software, identity management
Vendor: Samba
Description
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to a symlink following issue within the RPC endpoint emulating the Windows registry service API. A remote unprivileged attacker with ability to create a symlink can create a new registry hive file anywhere they have unix permissions to create a new file within a Samba share.
Successful exploitation of this vulnerability may allow an attacker to detect presence of exiting files on the system or perform phishing attacks and trick other users to upload files into insecure locations.Mitigation
Install updates from vendor's website.
Vulnerable software versions
Samba: 4.8.0 - 4.8.10, 4.9.0 - 4.9.5, 4.10.0 - 4.10.1
External links
https://www.samba.org/samba/security/CVE-2019-3880.html
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.