6.1
CVE-2019-3870
- EPSS 0.68%
- Veröffentlicht 09.04.2019 16:29:01
- Zuletzt bearbeitet 14.01.2025 19:29:55
- Quelle secalert@redhat.com
- Teams Watchlist Login
- Unerledigt Login
A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Fedora Version29
Fedoraproject ≫ Fedora Version30
Synology ≫ Directory Server Version-
Synology ≫ Router Manager Version1.2
Synology ≫ Diskstation Manager Version5.2
Synology ≫ Diskstation Manager Version6.1
Synology ≫ Diskstation Manager Version6.2
Synology ≫ Skynas Firmware Version-
Synology ≫ Vs960hd Firmware Version < 2.3.6-1720
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.68% | 0.708 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 1.8 | 4.2 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
|
| nvd@nist.gov | 3.6 | 3.9 | 4.9 |
AV:L/AC:L/Au:N/C:N/I:P/A:P
|
| secalert@redhat.com | 6.1 | 1.8 | 4.2 |
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
|
CWE-276 Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.