CVSS: 6.5EPSS: 1%CPEs: 9EXPL: 0CVE-2018-16841
https://notcve.org/view.php?id=CVE-2018-16841
Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process. Samba, desde la versión 4.3.0 antes de las versiones 4.7.12, 4.8.7 y 4.9.3, es vulnerable a una denegación de servicio (DoS). Cuando se configura para aceptar la autenticación por smartcard, el KDC de Samba llamará a talloc_free() dos veces en la misma memoria si la entidad de seguridad en un certificado firmado de forma válida no coincide con la entidad en AS-REQ. • http://www.securityfocus.com/bid/106023 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16841 https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://usn.ubuntu.com/3827-1 https://usn.ubuntu.com/3827-2 https://www.debian.org/security/2018/dsa-4345 https://www.samba.org/samba/security/CVE-2018-16841.html • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 0CVE-2018-16851
https://notcve.org/view.php?id=CVE-2018-16851
Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service. Samba, desde la versión 4.0.0 antes de las versiones 4.7.12, 4.8.7 y 4.9.3, es vulnerable a una denegación de servicio (DoS). • http://www.securityfocus.com/bid/106027 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16851 https://lists.debian.org/debian-lts-announce/2018/12/msg00005.html https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://usn.ubuntu.com/3827-1 https://usn.ubuntu.com/3827-2 https://www.debian.org/security/2018/dsa-4345 https://www.samba.org/samba/security/CVE-2018-16851.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 10EXPL: 1CVE-2018-14629
https://notcve.org/view.php?id=CVE-2018-14629
A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service. Se ha descubierto una vulnerabilidad de denegación de servicio (DoS) en el servidor LDAP de Samba en versiones anteriores a la 4.7.12, 4.8.7, y 4.9.3. Un bucle CNAME podría conducir a una recursión infinita en el servidor. • http://www.securityfocus.com/bid/106022 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14629 https://lists.debian.org/debian-lts-announce/2018/12/msg00005.html https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20181127-0001 https://usn.ubuntu.com/3827-1 https://usn.ubuntu.com/3827-2 https://www.debian.org/security/2018/dsa-4345 https://www.samba.org/samba/security/CVE-2018-14629.html • CWE-400: Uncontrolled Resource Consumption CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.5EPSS: 78%CPEs: 1EXPL: 0CVE-2018-1140
https://notcve.org/view.php?id=CVE-2018-1140
A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server, used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable Se ha detectado la ausencia de medidas de saneamiento de entradas en la implementación de la base de datos LDP utilizada para el servidor LDAP. Un atacante podría usar este fallo para causar una denegación de servicio (DoS) contra un servidor samba, usado como un controlador de dominio de directorio activo. Todas las versiones de Samba a partir de la 4.8.0 son vulnerables. • http://www.securityfocus.com/bid/105082 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1140 https://bugzilla.samba.org/show_bug.cgi?id=13374 https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20180814-0001 https://www.samba.org/samba/security/CVE-2018-1140.html • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-1139 – samba: Weak authentication protocol regression
https://notcve.org/view.php?id=CVE-2018-1139
A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client. Se ha detectado un fallo en la manera en la que samba en versiones anteriores a la 4.7.9 y 4.8.4 permitía el uso de la autenticación NTLMv1 débil incluso cuando NTLMv1 estaba explícitamente deshabilitado. Un atacante Man-in-the-Middle (MitM) podría utilizar este fallo para leer la credencial y otros detalles pasados entre el servidor y cliente de samba. A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. • http://www.securityfocus.com/bid/105084 https://access.redhat.com/errata/RHSA-2018:2612 https://access.redhat.com/errata/RHSA-2018:2613 https://access.redhat.com/errata/RHSA-2018:3056 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1139 https://security.gentoo.org/glsa/202003-52 https://security.netapp.com/advisory/ntap-20180814-0001 https://usn.ubuntu.com/3738-1 https://www.samba.org/samba/security/CVE-2018-1139.html https://access.redhat.com/security/cve/CV • CWE-20: Improper Input Validation CWE-522: Insufficiently Protected Credentials •