PT-2018-3372 · Samba+2 · Samba+2

Andrej Gessel + 1 · Published 2018-08-14 · Updated 2024-06-15 · CVE-2018-1140

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Samba versions 4.8.0 and later

Description: The issue is related to a missing input sanitization flaw in the implementation of the LDP database used for the LDAP server, which can be exploited to cause a denial of service against a Samba server used as an Active Directory Domain Controller. This can allow an attacker to cause the server to crash, resulting in a denial of service. The vulnerability is also associated with a lack of null pointer check, enabling malicious actors to trigger a crash of the LDAP and DNS server.

Recommendations: For Samba versions 4.8.0 and later, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-2166

ALT-PU-2018-2167

ALT-PU-2018-2168

ALT-PU-2018-2488

ALT-PU-2018-2489

ALT-PU-2018-2600

BDU:2020-00694

CVE-2018-1140

ECHO-DE15-31C1-C2E8

OPENSUSE-SU-2018_2400-1

OPENSUSE-SU-2024:10911-1

OPENSUSE-SU-2024:11365-1

SUSE-SU-2018:2318-1

Affected Products

Alt Linux

Samba

Suse

References · 91

• https://osv.dev/vulnerability/SUSE-SU-2018:2318-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1140 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1140 · Patch
• https://samba.org/samba/security/CVE-2018-1140.html · Vendor Advisory
• https://bugzilla.samba.org/show_bug.cgi?id=13374 · Patch
• https://security.gentoo.org/glsa/202003-52 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1140 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1140 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1140 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2018-1140 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1140 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1140 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00694 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10911-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1140 · Vendor Advisory