A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code, cause a Denial       of Service condition, conduct a man-in-the-middle attack, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for samba fixes the following issues :

The following security vulnerabilities were fixed :

  - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't     allow it; (bsc#1095048)

  - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and     DNS query with escapes crashes; (bsc#1095056)

  - CVE-2018-10919: Confidential attribute disclosure via     substring search; (bsc#1095057)

  - CVE-2018-10858: smbc_urlencode helper function is a     subject to buffer overflow; (bsc#1103411)

  - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames     on a user without a SPN; (bsc#1103414)

This update was imported from the SUSE:SLE-15:Update update project.

Update to Samba 4.8.4, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues: The following security vulnerabilities were fixed :

  - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't     allow it; (bsc#1095048)

  - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and     DNS query with escapes crashes; (bsc#1095056)

  - CVE-2018-10919: Confidential attribute disclosure via     substring search; (bsc#1095057)

  - CVE-2018-10858: smbc_urlencode helper function is a     subject to buffer overflow; (bsc#1103411)

  - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames     on a user without a SPN; (bsc#1103414)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.7.9, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Samba running on the remote host is 4.6.x prior to 4.6.16, or 4.7.x prior to 4.7.9, or 4.8.x prior to 4.8.4. It is, therefore, affected by multiple vulnerabilities.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3738-1 advisory.

    Svyatoslav Phirsov discovered that the Samba libsmbclient library incorrectly handled extra long     filenames. A malicious server could use this issue to cause Samba to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2018-10858)

    Volker Mauel discovered that Samba incorrectly handled database output. When used as an Active Directory     Domain Controller, a remote authenticated attacker could use this issue to cause Samba to crash, resulting     in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10918)

    Phillip Kuhrt discovered that the Samba LDAP server incorrectly handled certain confidential attribute     values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive     information. (CVE-2018-10919)

    Vivek Das discovered that Samba incorrectly handled NTLMv1 being explicitly disabled on the server. A     remote user could possibly be authenticated using NTLMv1, contrary to expectations. This issue only     affected Ubuntu 18.04 LTS. (CVE-2018-1139)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The samba project reports :

Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which allows authentication using NTLMv1 over an SMB1 transport (either directory or via NETLOGON SamLogon calls from a member server), even when NTLMv1 is explicitly disabled on the server.

Missing input sanitization checks on some of the input parameters to LDB database layer cause the LDAP server and DNS server to crash when following a NULL pointer.

Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in libsmbclient that could allow a malicious server to overwrite client heap memory by returning an extra long filename in a directory listing.

Missing database output checks on the returned directory attributes from the LDB database layer cause the DsCrackNames call in the DRSUAPI server to crash when following a NULL pointer.

All versions of the Samba Active Directory LDAP server from 4.0.0 onwards are vulnerable to the disclosure of confidential attribute values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL (0x80) searchFlags bit and where an explicit Access Control Entry has been specified on the ntSecurityDescriptor.

ID	Name	Product	Family	Severity
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	critical
134927	GLSA-202003-52 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
123268	openSUSE Security Update : samba (openSUSE-2019-617)	Nessus	SuSE Local Security Checks	high
120746	Fedora 28 : 2:samba / libldb (2018-bc22d6c7bc)	Nessus	Fedora Local Security Checks	high
120077	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:2318-1)	Nessus	SuSE Local Security Checks	high
112051	Fedora 27 : 2:samba (2018-8e4d871867)	Nessus	Fedora Local Security Checks	high
112000	openSUSE Security Update : samba (openSUSE-2018-891)	Nessus	SuSE Local Security Checks	high
111974	4.6.x < 4.6.16 / 4.7.x < 4.7.9 / 4.8.x < 4.8.4 Multiple Vulnerabilities	Nessus	Misc.	high
111748	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Samba vulnerabilities (USN-3738-1)	Nessus	Ubuntu Local Security Checks	high
111722	FreeBSD : samba -- multiple vulnerabilities (c4e9a427-9fc2-11e8-802a-000c29a1e3ec)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-10918

medium

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high