What’s Vulnerable › Vulnerabilities

CVE-2019-3880

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-09 · updated 2026-06-17
• Weakness: CWE-22

Description

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.

Affected products

• Debian Linux: 8.0
• Fedoraproject Fedora: 28, 29, 30
• openSUSE Leap: 42.3
• Red Hat Enterprise Linux: 7.0
• Red Hat, Inc. Gluster Storage for RHEL 6: 3.0
• Samba: from 3.2.0 before 4.8.11; from 4.9.0 before 4.9.6; from 4.10.0 before 4.10.2 — fixed in 4.10.2, 4.8.11, 4.9.6

How to fix

Upgrade to a fixed version: Samba 4.10.2, 4.8.11, 4.9.6. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00050.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00106.html
• https://access.redhat.com/errata/RHSA-2019:1966
• https://access.redhat.com/errata/RHSA-2019:1967
• https://access.redhat.com/errata/RHSA-2019:2099
• https://access.redhat.com/errata/RHSA-2019:3582
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3880
• https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6354GALK73CZWQKFUG7AWB6EIEGFMF62/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRLRO7BPRFETVFZ4TVJL2VFZEPHKJY4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTJVFA3RZ6G2IZDTVKLHRMX6QBYA4GPA/
• https://security.netapp.com/advisory/ntap-20190411-0004/

Get alerted when CVE-2019-3880 or the next vulnerability affects your stack