Vulnerability Description
A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | >= 4.9.0, <= 4.9.13 |
| Canonical | Ubuntu Linux | 19.04 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00045.html
- https://access.redhat.com/errata/RHSA-2019:3253
- https://access.redhat.com/errata/RHSA-2019:4023
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197Issue TrackingMitigationThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://seclists.org/bugtraq/2019/Sep/4Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202003-52
- https://security.netapp.com/advisory/ntap-20190903-0001/Third Party Advisory
- https://support.f5.com/csp/article/K69511801
- https://support.f5.com/csp/article/K69511801?utm_source=f5support&%3Butm_medi
- https://usn.ubuntu.com/4121-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4513Third Party Advisory
- https://www.samba.org/samba/security/CVE-2019-10197.htmlVendor Advisory
FAQ
What is CVE-2019-10197?
CVE-2019-10197 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated ...
How severe is CVE-2019-10197?
CVE-2019-10197 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10197?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Samba, Canonical Ubuntu Linux, Debian Debian Linux.