FreeBSD5F0DD349-40A2-11EA-8D8C-005056A311D1samba -- multiple vulnerabilities
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
5.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
0.006 Low
EPSS
Percentile
78.2%
The Samba Team reports:
CVE-2019-14902
The implementation of ACL inheritance in the Samba AD DC was not complete,
and so absent a ‘full-sync’ replication, ACLs could get out of sync between
domain controllers.
CVE-2019-14907
When processing untrusted string input Samba can read past the end of the
allocated buffer when printing a “Conversion error” message to the logs.
CVE-2019-19344
During DNS zone scavenging (of expired dynamic entries) there is a read of
memory after it has been freed.
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
5.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
0.006 Low
EPSS
Percentile
78.2%