CVE-2019-3880 Path traversal in samba
An unprivileged attacker can create arbitrary files in Samba shares via a path traversal flaw in the registry RPC endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-3880?
CVE-2019-3880 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 9 Apr 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.
Weakness: CWE-22
Which versions are affected by CVE-2019-3880?
It affects 6 products.
Linux distribution packages (40)
libsmbclient Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
libsmbclient-devel Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
libwbclient Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
libwbclient-devel Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-client Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-client-libs Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-common Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-common-libs Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-common-tools Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-dc Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-dc-libs Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-devel Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-krb5-printing Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-libs Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-pidl Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-python Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-python-test Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-test Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-test-libs Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-vfs-glusterfs Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-winbind Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-winbind-clients Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-winbind-krb5-locator Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
samba-winbind-modules Red Hat:enterprise_linux:7::client | All versions | 0:4.9.1-6.el7 |
libsmbclient Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
libsmbclient-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
libwbclient Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
libwbclient-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-client Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-client-libs Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-common Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-common-libs Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-common-tools Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-dc Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-dc-libs Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
samba-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:4.9.1-6.el7 |
Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Redhat Enterprise Linux, Redhat Gluster Storage, Samba Samba.
How do I fix CVE-2019-3880?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-3880 being exploited?
There is no known exploitation of CVE-2019-3880 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2019-3880, DEBIAN-CVE-2019-3880, DSA-4427-1, ECHO-5d38-846c-f790, GHSA-rf5r-8qc3-595p, RHSA-2019:1966 and 12 more.