Skip to content
Fencer Vulns
medium 4.2

CVE-2019-3880 json

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API.

published 2019-04-09 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-13491

cvss
4.2
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.

Patch / fix

  • samba samba 4.8.11, 4.9.6, 4.10.2
  • samba Debian 14, Debian 13, Debian 12 2:4.9.5+dfsg-3

debian advisories DEBIAN-CVE-2019-3880

  • samba Ubuntu 14.04 LTS 2:4.3.11+dfsg-0ubuntu0.14.04.20
  • samba Ubuntu 16.04 LTS 2:4.3.11+dfsg-0ubuntu0.16.04.19
  • samba Ubuntu 18.04 LTS 2:4.7.6+dfsg~ubuntu-0ubuntu2.9

ubuntu advisories UBUNTU-CVE-2019-3880

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • samba RHEL 8 4.10.4-1.el8
  • ctdb RHEL 8 4.10.4-1.el8
  • ctdb-tests RHEL 8 4.10.4-1.el8
  • samba-libs RHEL 8 4.10.4-1.el8
  • samba-pidl RHEL 8 4.10.4-1.el8
  • samba-test RHEL 8 4.10.4-1.el8
  • libwbclient RHEL 8 4.10.4-1.el8
  • libsmbclient RHEL 8 4.10.4-1.el8

red hat advisories RHSA-2019:3582RHSA-2019:1966RHSA-2019:1967RHSA-2019:2099

  • samba SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 3.6.3-94.19.2
  • samba SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +3 more 4.4.2-38.25.1
  • samba SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES 12 SP2-LTSS +5 more 4.2.4-28.32.1
  • samba SLES 12-LTSS, SLE High Availability Extension 12 4.2.4-18.52.1
  • samba SLE Module for Package Hub 15, SLE Module for Basesystem 15, SLE High Availability Extension 15 4.7.11+git.153.b36ceaf2235-4.27.1
  • ldb SLE Module for Basesystem 15 1.2.4-3.12.1
  • tdb SLE Module for Basesystem 15 1.3.15-3.6.3
  • cups SLE Module for Development Tools 15, SLE Module for Desktop Applications 15, SLE Module for Basesystem 15 2.2.7-3.11.7

suse advisories SUSE-SU-2019:14042-1SUSE-SU-2019:1203-1SUSE-SU-2019:1195-1SUSE-SU-2019:1194-1SUSE-SU-2019:1040-1SUSE-SU-2019:1037-1

  • samba openSUSE Tumbleweed 4.14.6+git.182.2205d5224e3-1.1
  • samba openSUSE Leap 15.0 4.7.11+git.153.b36ceaf2235-lp150.3.14.1
  • ldb openSUSE Leap 15.0 1.2.4-lp150.10.1

opensuse advisories openSUSE-SU-2024:11365-1openSUSE-SU-2019:1180-1

  • samba Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 4.8.11-r0
  • samba Alpine 3.6 4.6.16-r1
  • samba Alpine 3.7 4.7.6-r3

alpine advisories ALPINE-CVE-2019-3880

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-3880 updated cvss 4.2

samba: save registry file outside share as unprivileged user

  • Red Hat Enterprise Linux 5 samba Red Hat Enterprise Linux 6 samba, samba4, samba4-dc, samba-swat, samba4-libs, samba4-pidl, +17 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder (v. 8) ctdb-debuginfo 4.10.4-1.el8, samba-debuginfo 4.10.4-1.el8, libwbclient-devel 4.10.4-1.el8, samba-debugsource 4.10.4-1.el8, libsmbclient-devel 4.10.4-1.el8, ctdb-tests-debuginfo 4.10.4-1.el8, +16 more Red Hat Enterprise Linux AppStream (v. 8) samba-test 4.10.4-1.el8 Red Hat Enterprise Linux BaseOS (v. 8) ctdb 4.10.4-1.el8, samba 4.10.4-1.el8, ctdb-tests 4.10.4-1.el8, samba-libs 4.10.4-1.el8, samba-pidl 4.10.4-1.el8, libwbclient 4.10.4-1.el8, +14 more
    fixed: vendor fix RHSA-2019:3582
  • Red Hat Enterprise Linux Client (v. 7) samba 4.9.1-6.el7, samba-libs 4.9.1-6.el7, libwbclient 4.9.1-6.el7, libsmbclient 4.9.1-6.el7, samba-client 4.9.1-6.el7, samba-common 4.9.1-6.el7, +7 more Red Hat Enterprise Linux Client Optional (v. 7) samba 4.9.1-6.el7, samba-dc 4.9.1-6.el7, samba-pidl 4.9.1-6.el7, samba-test 4.9.1-6.el7, samba-python 4.9.1-6.el7, samba-dc-libs 4.9.1-6.el7, +4 more Red Hat Enterprise Linux ComputeNode (v. 7) samba 4.9.1-6.el7, samba-libs 4.9.1-6.el7, libwbclient 4.9.1-6.el7, libsmbclient 4.9.1-6.el7, samba-client 4.9.1-6.el7, samba-common 4.9.1-6.el7, +6 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) samba 4.9.1-6.el7, samba-dc 4.9.1-6.el7, samba-pidl 4.9.1-6.el7, samba-test 4.9.1-6.el7, samba-python 4.9.1-6.el7, samba-dc-libs 4.9.1-6.el7, +5 more Red Hat Enterprise Linux Server (v. 7) samba 4.9.1-6.el7, samba-libs 4.9.1-6.el7, libwbclient 4.9.1-6.el7, libsmbclient 4.9.1-6.el7, samba-client 4.9.1-6.el7, samba-common 4.9.1-6.el7, +8 more Red Hat Enterprise Linux Server Optional (v. 7) samba-dc 4.9.1-6.el7, samba-pidl 4.9.1-6.el7, samba-test 4.9.1-6.el7, samba-python 4.9.1-6.el7, samba-dc-libs 4.9.1-6.el7, samba-test-libs 4.9.1-6.el7, +3 more
    +3 more products
    Red Hat Enterprise Linux Server Resilient Storage (v. 7) ctdb 4.9.1-6.el7, ctdb-tests 4.9.1-6.el7 Red Hat Enterprise Linux Workstation (v. 7) samba 4.9.1-6.el7, samba-libs 4.9.1-6.el7, libwbclient 4.9.1-6.el7, libsmbclient 4.9.1-6.el7, samba-client 4.9.1-6.el7, samba-common 4.9.1-6.el7, +8 more Red Hat Enterprise Linux Workstation Optional (v. 7) samba-dc 4.9.1-6.el7, samba-pidl 4.9.1-6.el7, samba-test 4.9.1-6.el7, samba-dc-libs 4.9.1-6.el7, samba-test-libs 4.9.1-6.el7, samba-python-test 4.9.1-6.el7, +2 more
    fixed: vendor fix RHSA-2019:2099
  • Red Hat Gluster 3.4 Samba on RHEL-6 ctdb 4.9.8-105.el6rhs, libtdb 1.3.16-3.el6rhs, samba 4.9.8-105.el6rhs, pytalloc 2.1.14-3.el6rhs, libtalloc 2.1.14-3.el6rhs, libtevent 0.9.37-3.el6rhs, +21 more
    fixed: vendor fix RHSA-2019:1967
  • Red Hat Gluster 3.4 Samba on RHEL-7 ctdb 4.9.8-105.el7rhgs, libtdb 1.3.16-3.el7rhgs, samba 4.9.8-105.el7rhgs, pytalloc 2.1.14-3.el7rhgs, libtalloc 2.1.14-3.el7rhgs, libtevent 0.9.37-3.el7rhgs, +21 more
    fixed: vendor fix RHSA-2019:1966
  • Red Hat Virtualization 4 redhat-virtualization-host-image-update
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.24% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
NVD 2.0 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P

Affected products

  • The Samba Project samba

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.