PT-2018-3369 · Samba+3 · Samba+3

Published 2018-08-14 · Updated 2024-06-15 · CVE-2018-10918

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Samba versions prior to 4.7.9 Samba versions prior to 4.8.4

Description: The issue is related to a null pointer dereference flaw in the way Samba checks database outputs from the LDB database layer. This flaw can be exploited by an authenticated attacker to crash a Samba server, particularly in an Active Directory Domain Controller configuration, leading to a denial of service.

Recommendations: For Samba versions prior to 4.7.9, update to version 4.7.9 or later to resolve the issue. For Samba versions prior to 4.8.4, update to version 4.8.4 or later to resolve the issue.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-2167

ALT-PU-2018-2168

ALT-PU-2018-2488

ALT-PU-2018-2489

BDU:2020-00691

CVE-2018-10918

ECHO-86F7-6F5C-037E

OPENSUSE-SU-2018_2400-1

OPENSUSE-SU-2024:11365-1

SUSE-SU-2018:2318-1

USN-3738-1

Affected Products

Alt Linux

Samba

Suse

Ubuntu

References · 104

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-7494.md · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2017-7494 · Exploit
• 🔥 https://github.com/joxeankoret/CVE-2017-7494 · Exploit
• 🔥 https://github.com/betab0t/cve-2017-7494 · Exploit
• 🔥 https://github.com/d3fudd/CVE-2017-7494_SambaCry · Exploit
• 🔥 https://github.com/0xm4ud/noSAMBAnoCRY-CVE-2017-7494 · Exploit
• 🔥❌ https://github.com/elellacode/exploit-CVE-2017-7494 · Exploit, Deleted
• https://osv.dev/vulnerability/SUSE-SU-2018:2318-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3738-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10858 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00691 · Security Note
• https://ubuntu.com/security/notices/USN-3738-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10918 · Vendor Advisory