SB2019110684 - Fedora 31 update for samba

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019110684

SB2019110684 - Fedora 31 update for samba

Published: November 6, 2019 Updated: April 25, 2025

Security Bulletin ID SB2019110684
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2019-10218)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in filenames within Samba client code (libsmbclient). A malicious SMB server can return a filename to the client containing directory traversal characters and force the client to read or write data to local files.

Successful exploitation of the vulnerability may allow an attacker to overwrite arbitrary files on the client.


2) Use of Obsolete Function (CVE-ID: CVE-2019-14833)

The vulnerability allows a remote attacker to bypass implemented password policy.

The vulnerability exists due to Samba does not pass the entire user's password when configured to use custom command to verify password complexity, if the password contains multibyte non-ACSII characters. A remote authenticated user can bypass implemented password policy and create weak passwords.


Remediation

Install update from vendor's website.

References