CVE-2019-3870

    Dashboard / Vulnerabilities / CVE-2019-3870

    CVE-2019-3870

    Published: 9 Apr 2019Last Modified: 8 Jul 2026

    Summary:

    Details: A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

    References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6354GALK73CZWQKFUG7AWB6EIEGFMF62/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTJVFA3RZ6G2IZDTVKLHRMX6QBYA4GPA/, https://support.f5.com/csp/article/K20804356, https://www.synology.com/security/advisory/Synology_SA_19_15, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3870, https://bugzilla.samba.org/show_bug.cgi?id=13834, https://www.samba.org/samba/security/CVE-2019-3870.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4fc4ae2924aaa2fc184b7385069274526fa8a4c2
    Fixed -dd7b68d11c0c51033cdac339ee511acbd7750ce3

    Affected versions

    samba-4.10.1
    samba-4.10.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High