Vulnerability Details : CVE-2019-14861

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permissions on the DNS partition allow creation of new records by authenticated users. This is used for example to allow machines to self-register in DNS. If a DNS record was created that case-insensitively matched the name of the zone, the ldb_qsort() and dns_name_compare() routines could be confused into reading memory prior to the list of DNS entries when responding to DnssrvEnumRecords() or DnssrvEnumRecords2() and so following invalid memory as a pointer.
Published 2019-12-10 23:15:10
Updated 2024-06-25 02:15:10
Source Red Hat, Inc.
View at NVD,   CVE.org

Products affected by CVE-2019-14861

Threat overview for CVE-2019-14861

Top countries where our scanners detected CVE-2019-14861
Top open port discovered on systems with this issue 445
IPs affected by CVE-2019-14861 187,948
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2019-14861!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2019-14861

EPSS FAQ
1.01%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 84 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-14861

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
3.5
 LOW AV:N/AC:M/Au:S/C:N/I:N/A:P
6.8
2.9
 NIST
5.3
 MEDIUM CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
1.6
3.6
 Red Hat, Inc.
5.3
 MEDIUM CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
1.6
3.6
 NIST

CWE ids for CVE-2019-14861

  • During installation, installed file permissions are set to allow anyone to modify those files.
    Assigned by:
    • nvd@nist.gov (Secondary)
    • secalert@redhat.com (Primary)

References for CVE-2019-14861

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close