The Samba-Bugzilla – Attachment 14996 Details for
Bug 13851
CVE-2019-3880 [SECURITY] Save registry file outside share as unprivileged user in Samba 4.x
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
advisory with CVE (v2)
CVE-2019-3880-advisory-02.txt (text/plain), 1.94 KB, created by
Andrew Bartlett
on 2019-03-27 03:41:34 UTC
(
hide
)
Description:
advisory with CVE (v2)
Filename:
MIME Type:
Creator:
Andrew Bartlett
Created:
2019-03-27 03:41:34 UTC
Size:
1.94 KB
patch
obsolete
>=========================================================== >== Subject: Save registry file outside share as unprivileged user >== >== CVE ID#: CVE-2019-3880 >== >== Versions: All versions of Samba since Samba 3.x >== >== Summary: Authenticated users with write permission > can trigger a symlink traversal to write > files outside the Samba share. >=========================================================== > >=========== >Description >=========== > >Samba contains an RPC endpoint emulating the Windows registry service >API. One of the requests, "winreg_SaveKey", is susceptible to a >path/symlink traversal vulnerability. Unprivileged users can use it to >save a registry hive file anywhere they have write access, even >outside a Samba share. > >Samba writes the file as the authenticated user, not as root. > >================== >Patch Availability >================== > >Patches addressing both these issues have been posted to: > > http://www.samba.org/samba/security/ > >Additionally, Samba 4.8.11, 4.9.6 and 4.10.2 have been issued >as security releases to correct the defect. Samba administrators are >advised to upgrade to these releases or apply the patch as soon >as possible. > >================== >CVSSv3 calculation >================== > >CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4) > >========== >Workaround >========== > >A read only share (via filesystem permissions) holding no symbolic >links would mitigate the attack. Likewise for a write-enabled share >holding no symbolic links setting 'unix extensions = no' or 'min >protocol = SMB2' in the smb.conf would mitigate the attack. > >======= >Credits >======= > >Originally reported by Michael Hanselmann. > >Patches provided by Jeremy Allison of the Samba Team and Google. >Advisory written by Andrew Bartlett of the Samba Team and Catalyst. > >========================================================== >== Our Code, Our Bugs, Our Responsibility. >== The Samba Team >========================================================== >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 13851
:
14974
|
14975
|
14996
|
14997
|
14998
|
14999
|
15000
|
15001
|
15010
|
15011
|
15012
|
15028
|
15030