AZL-45057

    Dashboard / Vulnerabilities / AZL-45057

    AZL-45057

    Published: 9 Apr 2019Last Modified: 21 Apr 2026
    Upstream:
    CVE-2019-3870

    Summary: CVE-2019-3870 affecting package samba for versions less than 4.18.3-1

    Details: A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

    References: https://nvd.nist.gov/vuln/detail/CVE-2019-3870

    Affected packages

    Package

    Name: samba

    Purl: pkg:rpm/azure-linux/samba

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.18.3-1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    AZL-45057 | CVE-DB