CVE-2019-10197 A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated....
CriticalCVSS 9.1
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/samba(Debian:12) | < 2:4.9.13+dfsg-1 | 2:4.9.13+dfsg-1 |
| debian/samba(Debian:13) | < 2:4.9.13+dfsg-1 | 2:4.9.13+dfsg-1 |
| debian/samba(Debian:14) | < 2:4.9.13+dfsg-1 | 2:4.9.13+dfsg-1 |
| samba | >= 4.9.0, <= 4.9.13 | No fix listed |
| samba | >= 4.10.0, <= 4.10.8 | No fix listed |
| samba | = 4.9.0-rc1 | No fix listed |
| samba | = 4.9.0-rc2 | No fix listed |
| samba | = 4.9.0-rc3 | No fix listed |
| samba | = 4.9.0-rc4 | No fix listed |
| samba | = 4.9.0-rc5 | No fix listed |
| samba | = 4.10.0-rc1 | No fix listed |
| samba | = 4.10.0-rc2 | No fix listed |
| samba | = 4.10.0-rc3 | No fix listed |
| samba | = 4.10.0-rc4 | No fix listed |
| samba | = 4.11.0 | No fix listed |
| samba | = 4.11.0-rc1 | No fix listed |
| samba | = 4.11.0-rc2 | No fix listed |
| samba | = 4.11.0-rc3 | No fix listed |
| Canonical Ubuntu Linux | = 19.04 | No fix listed |
| debian linux | = 10.0 | No fix listed |
| alpine/samba(Alpine:v3.10) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.11) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.12) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.13) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.14) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/samba(Alpine:v3.15) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.16) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.17) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.18) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.19) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.20) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.21) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.22) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.23) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| alpine/samba(Alpine:v3.24) | >= 4.9.0, < 4.10.8-r0 | 4.10.8-r0 |
| samba | = samba 4.9.x up to 4.9.13 | No fix listed |
| samba | = samba 4.10.x up to 4.10.8 | No fix listed |
| samba | = samba 4.11.x up to 4.11.0rc3 | No fix listed |
References
- Debian Security Tracker CVE-2019-10197 vendor-advisory
- openSUSE-SU-2019:2142 vendor-advisory
- RHSA-2019:3253 vendor-advisory
- RHSA-2019:4023 vendor-advisory
- bugzilla.redhat.com issue-tracking mitigation third-party-advisory
- FEDORA-2019-eb1e982800 vendor-advisory
- FEDORA-2019-e3e521e5b3 vendor-advisory
- FEDORA-2019-41c7fa478a vendor-advisory
- 20190904 [SECURITY] [DSA 4513-1] samba security update mailing-list third-party-advisory
- GLSA-202003-52 vendor-advisory
- security.netapp.com third-party-advisory
- support.f5.com
- support.f5.com
- USN-4121-1 third-party-advisory vendor-advisory
- DSA-4513 third-party-advisory vendor-advisory
- www.samba.org vendor-advisory
- security.alpinelinux.org vendor-advisory