CVE-2019-10197

EUVD-2019-2218
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
redhatCNA
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
sambasamba
4.9.0 ≤
𝑥
≤ 4.9.13
sambasamba
4.10.0 ≤
𝑥
≤ 4.10.8
sambasamba
4.9.0:rc1
sambasamba
4.9.0:rc2
sambasamba
4.9.0:rc3
sambasamba
4.9.0:rc4
sambasamba
4.9.0:rc5
sambasamba
4.10.0:rc1
sambasamba
4.10.0:rc2
sambasamba
4.10.0:rc3
sambasamba
4.10.0:rc4
sambasamba
4.11.0
sambasamba
4.11.0:rc1
sambasamba
4.11.0:rc2
sambasamba
4.11.0:rc3
canonicalubuntu_linux
19.04
debiandebian_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
samba
bookworm
2:4.17.12+dfsg-0+deb12u1
fixed
bookworm (security)
2:4.17.12+dfsg-0+deb12u1
fixed
bullseye
2:4.13.13+dfsg-1~deb11u6
fixed
bullseye (security)
2:4.13.13+dfsg-1~deb11u6
fixed
jessie
not-affected
sid
2:4.21.1+dfsg-2
fixed
stretch
not-affected
trixie
2:4.21.1+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
samba
bionic
not-affected
disco
Fixed 2:4.10.0+dfsg-0ubuntu2.4
released
trusty
not-affected
xenial
not-affected
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00045.html
https://access.redhat.com/errata/RHSA-2019:3253
https://access.redhat.com/errata/RHSA-2019:4023
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56ZUXHGDHPM7S6RVAKULZT5EATS37OKA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7NYIUZOCIDXWXGWMZ7O5Z7OJ6IX7EAB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z6EEKFT24DQI4DMZMSQTLMNZWG4RMZ57/
https://seclists.org/bugtraq/2019/Sep/4
https://security.gentoo.org/glsa/202003-52
https://security.netapp.com/advisory/ntap-20190903-0001/
https://support.f5.com/csp/article/K69511801
https://support.f5.com/csp/article/K69511801?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4121-1/
https://www.debian.org/security/2019/dsa-4513
https://www.samba.org/samba/security/CVE-2019-10197.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00045.html
https://access.redhat.com/errata/RHSA-2019:3253
https://access.redhat.com/errata/RHSA-2019:4023
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/56ZUXHGDHPM7S6RVAKULZT5EATS37OKA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7NYIUZOCIDXWXGWMZ7O5Z7OJ6IX7EAB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z6EEKFT24DQI4DMZMSQTLMNZWG4RMZ57/
https://seclists.org/bugtraq/2019/Sep/4
https://security.gentoo.org/glsa/202003-52
https://security.netapp.com/advisory/ntap-20190903-0001/
https://support.f5.com/csp/article/K69511801
https://support.f5.com/csp/article/K69511801?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/4121-1/
https://www.debian.org/security/2019/dsa-4513
https://www.samba.org/samba/security/CVE-2019-10197.html