Security readout for executives and security teams
Plain-English summary
This flaw can let an authenticated SMB user with extended-attribute write rights change file permissions unintentionally. For affected illumos-based storage systems, limited write access could become access to sensitive files or unauthorized data changes. It is high risk where SMB shares are reachable by untrusted or low-privilege users.
Executive priority
Treat this as a high-priority storage access-control issue if affected SMB shares contain sensitive business data or support many users. Patch planning should be prompt, but current sources do not prove active exploitation.
Technical view
The issue combines ZFS extended attributes used for NT named streams, SMB open-handle semantics, and SMB server forwarding of some attribute requests to the underlying object. A user with WRITE_XATTR can affect object permissions instead of only the named stream, creating unintended access.
Likely exposure
Exposure is most likely on illumos-derived SMB servers, explicitly including NexentaStor 4.0.5 and 5.1.2. The source says “other products” but does not identify them, so inventory must be vendor-led.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not state active exploitation. Exploitation requires network access to SMB and low-privileged rights, specifically the ability to write extended attributes.
Researcher notes
CWE-276 fits the permission-management impact. The vulnerable behavior depends on SMB named-stream handling over ZFS extended attributes and request forwarding to the base object. Product scope beyond the named NexentaStor versions is incomplete in the provided evidence.
Mitigation direction
- Check illumos, Nexenta, and Oracle advisories for applicable fixes or supported upgrade paths.
- Prioritize patching SMB storage systems serving untrusted or broad user populations.
- Restrict SMB access to trusted networks and authenticated users only.
- Reduce or remove unnecessary WRITE_XATTR rights on sensitive shares.
- Monitor for unexpected permission or ACL changes on SMB-hosted data.
Validation and detection
- Inventory SMB servers built on illumos or NexentaStor.
- Confirm whether NexentaStor 4.0.5 or 5.1.2 is present.
- Review vendor patch levels against the cited advisories.
- Audit shares where users can write extended attributes.
- Check logs or file metadata for unexplained permission changes.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-9579 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.illumos.org/issues/10506CVE reference
- https://www.oracle.com/security-alerts/cpuapr2020.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.