Every CVE Search/ Get API key

CVE-2019-3870

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10...

6.1 MediumFix available

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.55%Down 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 6.1

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Record
CVE-2019-3870
CVSS 3.0
6.1 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-276
Updated
2026-11-02
EUVDEUVD-2019-13483 6.1

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Record
EUVD-2019-13483
CVSS 3.0
6.1 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-xv9q-3jh5-9rrc 6.1

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10...

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Record
GHSA-xv9q-3jh5-9rrc
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-276
Updated
2026-11-02
NVD 6.1

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Record
CVE-2019-3870
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS 3.0
6.1 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Weakness
CWE-276
Updated
2026-11-02
OSVAZL-45057 6.1

CVE-2019-3870 affecting package samba for versions less than 4.18.3-1

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Record
AZL-45057
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSV 6.1

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Record
CVE-2019-3870
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-3870 6.1

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD DC, files are created in a private subdirectory of the install location. This directory is typically mode 0700, that is owner (root) only access. However in some upgraded installations it will have other permissions, such as 0755, because this was the default before Samba 4.8. Within this directory, files are created with mode 0666, which is world-writable, including a sample krb5.conf, and the list of DNS names and servicePrincipalName values to update.

Record
DEBIAN-CVE-2019-3870
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11365-1 No score

ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11365-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
samba
Azure Linux:3
 before 4.18.3-1
4.18.3-1
samba
Debian:12
 before 2:4.9.5+dfsg-3
2:4.9.5+dfsg-3
samba
Debian:13
 before 2:4.9.5+dfsg-3
2:4.9.5+dfsg-3
samba
Debian:14
 before 2:4.9.5+dfsg-3
2:4.9.5+dfsg-3
samba
openSUSE:Tumbleweed
From an advisory covering 66 CVEs
 before 4.14.6+git.182.2205d5224e3-1.1
4.14.6+git.182.2205d5224e3-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-3870 is a medium vulnerability (CVSS 6.1) in Samba, published April 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in samba 4.18.3-1.

References

Show 72 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open