ID CVE-2018-1139
Summary A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.
References
Vulnerable Configurations
  • Samba Samba
    cpe:2.3:a:samba:samba
  • Samba 1.9.17
    cpe:2.3:a:samba:samba:1.9.17
  • Samba 1.9.17 p1
    cpe:2.3:a:samba:samba:1.9.17:p1
  • Samba 1.9.17 p2
    cpe:2.3:a:samba:samba:1.9.17:p2
  • Samba 1.9.17 p3
    cpe:2.3:a:samba:samba:1.9.17:p3
  • Samba 1.9.17 p4
    cpe:2.3:a:samba:samba:1.9.17:p4
  • Samba 1.9.17 p5
    cpe:2.3:a:samba:samba:1.9.17:p5
  • Samba 1.9.18
    cpe:2.3:a:samba:samba:1.9.18
  • Samba 1.9.18 p1
    cpe:2.3:a:samba:samba:1.9.18:p1
  • Samba 1.9.18 p10
    cpe:2.3:a:samba:samba:1.9.18:p10
  • Samba 1.9.18 p2
    cpe:2.3:a:samba:samba:1.9.18:p2
  • Samba 1.9.18 p3
    cpe:2.3:a:samba:samba:1.9.18:p3
  • Samba 1.9.18 p4
    cpe:2.3:a:samba:samba:1.9.18:p4
  • Samba 1.9.18 p5
    cpe:2.3:a:samba:samba:1.9.18:p5
  • Samba 1.9.18 p6
    cpe:2.3:a:samba:samba:1.9.18:p6
  • Samba 1.9.18 p7
    cpe:2.3:a:samba:samba:1.9.18:p7
  • Samba 1.9.18 p8
    cpe:2.3:a:samba:samba:1.9.18:p8
  • Samba Samba 2.0
    cpe:2.3:a:samba:samba:2.0
  • Samba 2.0.0
    cpe:2.3:a:samba:samba:2.0.0
  • Samba 2.0.1
    cpe:2.3:a:samba:samba:2.0.1
  • Samba 2.0.2
    cpe:2.3:a:samba:samba:2.0.2
  • Samba 2.0.3
    cpe:2.3:a:samba:samba:2.0.3
  • Samba 2.0.4
    cpe:2.3:a:samba:samba:2.0.4
  • Samba 2.0.5
    cpe:2.3:a:samba:samba:2.0.5
  • Samba 2.0.5a
    cpe:2.3:a:samba:samba:2.0.5:a
  • Samba Samba 2.0.5a
    cpe:2.3:a:samba:samba:2.0.5a
  • Samba 2.0.6
    cpe:2.3:a:samba:samba:2.0.6
  • Samba 2.0.7
    cpe:2.3:a:samba:samba:2.0.7
  • Samba 2.0.8
    cpe:2.3:a:samba:samba:2.0.8
  • Samba 2.0.9
    cpe:2.3:a:samba:samba:2.0.9
  • Samba 2.0.10
    cpe:2.3:a:samba:samba:2.0.10
  • Samba 2.2a
    cpe:2.3:a:samba:samba:2.2:a
  • Samba 2.2.0
    cpe:2.3:a:samba:samba:2.2.0
  • Samba 2.2.0a
    cpe:2.3:a:samba:samba:2.2.0:a
  • Samba Samba 2.2.0a
    cpe:2.3:a:samba:samba:2.2.0a
  • Samba 2.2.1
    cpe:2.3:a:samba:samba:2.2.1
  • Samba 2.2.1a
    cpe:2.3:a:samba:samba:2.2.1:a
  • Samba Samba 2.2.1a
    cpe:2.3:a:samba:samba:2.2.1a
  • Samba 2.2.2
    cpe:2.3:a:samba:samba:2.2.2
  • Samba 2.2.3
    cpe:2.3:a:samba:samba:2.2.3
  • Samba 2.2.3a
    cpe:2.3:a:samba:samba:2.2.3:a
  • Samba Samba 2.2.3a
    cpe:2.3:a:samba:samba:2.2.3a
  • Samba 2.2.4
    cpe:2.3:a:samba:samba:2.2.4
  • Samba 2.2.5
    cpe:2.3:a:samba:samba:2.2.5
  • Samba 2.2.6
    cpe:2.3:a:samba:samba:2.2.6
  • Samba 2.2.7
    cpe:2.3:a:samba:samba:2.2.7
  • Samba 2.2.7a
    cpe:2.3:a:samba:samba:2.2.7:a
  • Samba Samba 2.2.7a
    cpe:2.3:a:samba:samba:2.2.7a
  • Samba 2.2.8
    cpe:2.3:a:samba:samba:2.2.8
  • Samba 2.2.8a
    cpe:2.3:a:samba:samba:2.2.8:a
  • Samba Samba 2.2.8a
    cpe:2.3:a:samba:samba:2.2.8a
  • Samba 2.2.9
    cpe:2.3:a:samba:samba:2.2.9
  • Samba 2.2.10
    cpe:2.3:a:samba:samba:2.2.10
  • Samba 2.2.11
    cpe:2.3:a:samba:samba:2.2.11
  • Samba 2.2.12
    cpe:2.3:a:samba:samba:2.2.12
  • Samba Samba 2.2a
    cpe:2.3:a:samba:samba:2.2a
  • Samba 2.18.3
    cpe:2.3:a:samba:samba:2.18.3
  • Samba 3.0
    cpe:2.3:a:samba:samba:3.0
  • Samba 3.0.0
    cpe:2.3:a:samba:samba:3.0.0
  • Samba 3.0.1
    cpe:2.3:a:samba:samba:3.0.1
  • Samba 3.0.2
    cpe:2.3:a:samba:samba:3.0.2
  • Samba 3.0.2a
    cpe:2.3:a:samba:samba:3.0.2:a
  • Samba 3.0.2a
    cpe:2.3:a:samba:samba:3.0.2a
  • Samba 3.0.3
    cpe:2.3:a:samba:samba:3.0.3
  • Samba 3.0.4
    cpe:2.3:a:samba:samba:3.0.4
  • Samba 3.0.4 release candidate 1
    cpe:2.3:a:samba:samba:3.0.4:rc1
  • Samba 3.0.5
    cpe:2.3:a:samba:samba:3.0.5
  • Samba 3.0.6
    cpe:2.3:a:samba:samba:3.0.6
  • Samba 3.0.7
    cpe:2.3:a:samba:samba:3.0.7
  • Samba 3.0.8
    cpe:2.3:a:samba:samba:3.0.8
  • Samba 3.0.9
    cpe:2.3:a:samba:samba:3.0.9
  • Samba 3.0.10
    cpe:2.3:a:samba:samba:3.0.10
  • Samba 3.0.11
    cpe:2.3:a:samba:samba:3.0.11
  • Samba 3.0.12
    cpe:2.3:a:samba:samba:3.0.12
  • Samba 3.0.13
    cpe:2.3:a:samba:samba:3.0.13
  • Samba 3.0.14
    cpe:2.3:a:samba:samba:3.0.14
  • Samba 3.0.14a
    cpe:2.3:a:samba:samba:3.0.14:a
  • Samba 3.0.14a
    cpe:2.3:a:samba:samba:3.0.14a
  • Samba 3.0.15
    cpe:2.3:a:samba:samba:3.0.15
  • Samba 3.0.16
    cpe:2.3:a:samba:samba:3.0.16
  • Samba 3.0.17
    cpe:2.3:a:samba:samba:3.0.17
  • Samba 3.0.18
    cpe:2.3:a:samba:samba:3.0.18
  • Samba 3.0.19
    cpe:2.3:a:samba:samba:3.0.19
  • Samba 3.0.20
    cpe:2.3:a:samba:samba:3.0.20
  • Samba 3.0.20a
    cpe:2.3:a:samba:samba:3.0.20:a
  • Samba 3.0.20b
    cpe:2.3:a:samba:samba:3.0.20:b
  • Samba 3.0.20a
    cpe:2.3:a:samba:samba:3.0.20a
  • Samba 3.0.20b
    cpe:2.3:a:samba:samba:3.0.20b
  • Samba 3.0.21
    cpe:2.3:a:samba:samba:3.0.21
  • Samba 3.0.21a
    cpe:2.3:a:samba:samba:3.0.21:a
  • Samba 3.0.21b
    cpe:2.3:a:samba:samba:3.0.21:b
  • Samba 3.0.21c
    cpe:2.3:a:samba:samba:3.0.21:c
  • Samba 3.0.21a
    cpe:2.3:a:samba:samba:3.0.21a
  • Samba 3.0.21b
    cpe:2.3:a:samba:samba:3.0.21b
  • Samba 3.0.21c
    cpe:2.3:a:samba:samba:3.0.21c
  • Samba 3.0.22
    cpe:2.3:a:samba:samba:3.0.22
  • Samba 3.0.23
    cpe:2.3:a:samba:samba:3.0.23
  • Samba 3.0.23a
    cpe:2.3:a:samba:samba:3.0.23:a
  • Samba 3.0.23b
    cpe:2.3:a:samba:samba:3.0.23:b
  • Samba 3.0.23c
    cpe:2.3:a:samba:samba:3.0.23:c
  • Samba 3.0.23d
    cpe:2.3:a:samba:samba:3.0.23:d
  • Samba 3.0.23a
    cpe:2.3:a:samba:samba:3.0.23a
  • Samba 3.0.23b
    cpe:2.3:a:samba:samba:3.0.23b
  • Samba 3.0.23c
    cpe:2.3:a:samba:samba:3.0.23c
  • Samba 3.0.23d
    cpe:2.3:a:samba:samba:3.0.23d
  • Samba 3.0.24
    cpe:2.3:a:samba:samba:3.0.24
  • Samba 3.0.25
    cpe:2.3:a:samba:samba:3.0.25
  • Samba 3.0.25a
    cpe:2.3:a:samba:samba:3.0.25:a
  • Samba 3.0.25b
    cpe:2.3:a:samba:samba:3.0.25:b
  • Samba 3.0.25c
    cpe:2.3:a:samba:samba:3.0.25:c
  • Samba 3.0.25 pre1
    cpe:2.3:a:samba:samba:3.0.25:pre1
  • Samba 3.0.25 pre2
    cpe:2.3:a:samba:samba:3.0.25:pre2
  • Samba 3.0.25 release candidate 1
    cpe:2.3:a:samba:samba:3.0.25:rc1
  • Samba 3.0.25 release candiate 2
    cpe:2.3:a:samba:samba:3.0.25:rc2
  • Samba 3.0.25 release candidate 3
    cpe:2.3:a:samba:samba:3.0.25:rc3
  • Samba 3.0.25a
    cpe:2.3:a:samba:samba:3.0.25a
  • Samba 3.0.25b
    cpe:2.3:a:samba:samba:3.0.25b
  • Samba 3.0.25c
    cpe:2.3:a:samba:samba:3.0.25c
  • Samba 3.0.26
    cpe:2.3:a:samba:samba:3.0.26
  • Samba 3.0.26a
    cpe:2.3:a:samba:samba:3.0.26:a
  • Samba 3.0.26a
    cpe:2.3:a:samba:samba:3.0.26a
  • Samba 3.0.27
    cpe:2.3:a:samba:samba:3.0.27
  • Samba 3.0.27a
    cpe:2.3:a:samba:samba:3.0.27:a
  • Samba 3.0.28
    cpe:2.3:a:samba:samba:3.0.28
  • Samba 3.0.28a
    cpe:2.3:a:samba:samba:3.0.28:a
  • Samba 3.0.29
    cpe:2.3:a:samba:samba:3.0.29
  • Samba 3.0.30
    cpe:2.3:a:samba:samba:3.0.30
  • Samba 3.0.31
    cpe:2.3:a:samba:samba:3.0.31
  • Samba 3.0.32
    cpe:2.3:a:samba:samba:3.0.32
  • Samba 3.0.33
    cpe:2.3:a:samba:samba:3.0.33
  • Samba 3.0.34
    cpe:2.3:a:samba:samba:3.0.34
  • Samba 3.0.35
    cpe:2.3:a:samba:samba:3.0.35
  • Samba 3.0.36
    cpe:2.3:a:samba:samba:3.0.36
  • Samba 3.0.37
    cpe:2.3:a:samba:samba:3.0.37
  • Samba 3.1
    cpe:2.3:a:samba:samba:3.1
  • Samba 3.1.0
    cpe:2.3:a:samba:samba:3.1.0
  • Samba 3.2.0
    cpe:2.3:a:samba:samba:3.2.0
  • Samba 3.2.1
    cpe:2.3:a:samba:samba:3.2.1
  • Samba 3.2.2
    cpe:2.3:a:samba:samba:3.2.2
  • Samba 3.2.3
    cpe:2.3:a:samba:samba:3.2.3
  • Samba 3.2.4
    cpe:2.3:a:samba:samba:3.2.4
  • Samba 3.2.5
    cpe:2.3:a:samba:samba:3.2.5
  • Samba 3.2.6
    cpe:2.3:a:samba:samba:3.2.6
  • Samba 3.2.7
    cpe:2.3:a:samba:samba:3.2.7
  • Samba 3.2.8
    cpe:2.3:a:samba:samba:3.2.8
  • Samba 3.2.9
    cpe:2.3:a:samba:samba:3.2.9
  • Samba 3.2.10
    cpe:2.3:a:samba:samba:3.2.10
  • Samba 3.2.11
    cpe:2.3:a:samba:samba:3.2.11
  • Samba 3.2.12
    cpe:2.3:a:samba:samba:3.2.12
  • Samba 3.2.13
    cpe:2.3:a:samba:samba:3.2.13
  • Samba 3.2.14
    cpe:2.3:a:samba:samba:3.2.14
  • Samba 3.2.15
    cpe:2.3:a:samba:samba:3.2.15
  • Samba 3.3.0
    cpe:2.3:a:samba:samba:3.3.0
  • Samba 3.3.1
    cpe:2.3:a:samba:samba:3.3.1
  • Samba 3.3.2
    cpe:2.3:a:samba:samba:3.3.2
  • Samba 3.3.3
    cpe:2.3:a:samba:samba:3.3.3
  • Samba 3.3.4
    cpe:2.3:a:samba:samba:3.3.4
  • Samba 3.3.5
    cpe:2.3:a:samba:samba:3.3.5
  • Samba 3.3.6
    cpe:2.3:a:samba:samba:3.3.6
  • Samba 3.3.7
    cpe:2.3:a:samba:samba:3.3.7
  • Samba 3.3.8
    cpe:2.3:a:samba:samba:3.3.8
  • Samba 3.3.9
    cpe:2.3:a:samba:samba:3.3.9
  • Samba 3.3.10
    cpe:2.3:a:samba:samba:3.3.10
  • Samba 3.3.11
    cpe:2.3:a:samba:samba:3.3.11
  • Samba 3.3.12
    cpe:2.3:a:samba:samba:3.3.12
  • Samba 3.3.13
    cpe:2.3:a:samba:samba:3.3.13
  • Samba 3.3.14
    cpe:2.3:a:samba:samba:3.3.14
  • Samba 3.3.15
    cpe:2.3:a:samba:samba:3.3.15
  • Samba 3.3.16
    cpe:2.3:a:samba:samba:3.3.16
  • Samba 3.4.0
    cpe:2.3:a:samba:samba:3.4.0
  • Samba 3.4.1
    cpe:2.3:a:samba:samba:3.4.1
  • Samba 3.4.2
    cpe:2.3:a:samba:samba:3.4.2
  • Samba 3.4.3
    cpe:2.3:a:samba:samba:3.4.3
  • Samba 3.4.4
    cpe:2.3:a:samba:samba:3.4.4
  • Samba 3.4.5
    cpe:2.3:a:samba:samba:3.4.5
  • Samba 3.4.6
    cpe:2.3:a:samba:samba:3.4.6
  • Samba 3.4.7
    cpe:2.3:a:samba:samba:3.4.7
  • Samba 3.4.8
    cpe:2.3:a:samba:samba:3.4.8
  • Samba 3.4.9
    cpe:2.3:a:samba:samba:3.4.9
  • Samba 3.4.10
    cpe:2.3:a:samba:samba:3.4.10
  • Samba 3.4.11
    cpe:2.3:a:samba:samba:3.4.11
  • Samba 3.4.12
    cpe:2.3:a:samba:samba:3.4.12
  • Samba 3.4.13
    cpe:2.3:a:samba:samba:3.4.13
  • Samba 3.4.14
    cpe:2.3:a:samba:samba:3.4.14
  • Samba 3.4.15
    cpe:2.3:a:samba:samba:3.4.15
  • Samba 3.4.16
    cpe:2.3:a:samba:samba:3.4.16
  • Samba 3.4.17
    cpe:2.3:a:samba:samba:3.4.17
  • Samba 3.5.0
    cpe:2.3:a:samba:samba:3.5.0
  • Samba 3.5.1
    cpe:2.3:a:samba:samba:3.5.1
  • Samba 3.5.2
    cpe:2.3:a:samba:samba:3.5.2
  • Samba 3.5.3
    cpe:2.3:a:samba:samba:3.5.3
  • Samba 3.5.4
    cpe:2.3:a:samba:samba:3.5.4
  • Samba 3.5.5
    cpe:2.3:a:samba:samba:3.5.5
  • Samba 3.5.6
    cpe:2.3:a:samba:samba:3.5.6
  • Samba 3.5.7
    cpe:2.3:a:samba:samba:3.5.7
  • Samba 3.5.8
    cpe:2.3:a:samba:samba:3.5.8
  • Samba 3.5.9
    cpe:2.3:a:samba:samba:3.5.9
  • Samba 3.5.10
    cpe:2.3:a:samba:samba:3.5.10
  • Samba 3.5.11
    cpe:2.3:a:samba:samba:3.5.11
  • Samba 3.5.12
    cpe:2.3:a:samba:samba:3.5.12
  • Samba 3.5.13
    cpe:2.3:a:samba:samba:3.5.13
  • Samba 3.5.14
    cpe:2.3:a:samba:samba:3.5.14
  • Samba 3.5.15
    cpe:2.3:a:samba:samba:3.5.15
  • Samba 3.5.16
    cpe:2.3:a:samba:samba:3.5.16
  • Samba 3.5.17
    cpe:2.3:a:samba:samba:3.5.17
  • Samba 3.5.18
    cpe:2.3:a:samba:samba:3.5.18
  • Samba 3.5.19
    cpe:2.3:a:samba:samba:3.5.19
  • Samba 3.5.20
    cpe:2.3:a:samba:samba:3.5.20
  • Samba 3.5.21
    cpe:2.3:a:samba:samba:3.5.21
  • Samba 3.5.22
    cpe:2.3:a:samba:samba:3.5.22
  • Samba 3.6.0
    cpe:2.3:a:samba:samba:3.6.0
  • Samba 3.6.1
    cpe:2.3:a:samba:samba:3.6.1
  • Samba 3.6.2
    cpe:2.3:a:samba:samba:3.6.2
  • Samba 3.6.3
    cpe:2.3:a:samba:samba:3.6.3
  • Samba 3.6.4
    cpe:2.3:a:samba:samba:3.6.4
  • Samba 3.6.5
    cpe:2.3:a:samba:samba:3.6.5
  • Samba 3.6.6
    cpe:2.3:a:samba:samba:3.6.6
  • Samba 3.6.7
    cpe:2.3:a:samba:samba:3.6.7
  • Samba 3.6.8
    cpe:2.3:a:samba:samba:3.6.8
  • Samba 3.6.9
    cpe:2.3:a:samba:samba:3.6.9
  • Samba 3.6.10
    cpe:2.3:a:samba:samba:3.6.10
  • Samba 3.6.11
    cpe:2.3:a:samba:samba:3.6.11
  • Samba 3.6.12
    cpe:2.3:a:samba:samba:3.6.12
  • Samba 3.6.13
    cpe:2.3:a:samba:samba:3.6.13
  • Samba 3.6.14
    cpe:2.3:a:samba:samba:3.6.14
  • Samba 3.6.15
    cpe:2.3:a:samba:samba:3.6.15
  • Samba 3.6.16
    cpe:2.3:a:samba:samba:3.6.16
  • Samba 3.6.17
    cpe:2.3:a:samba:samba:3.6.17
  • Samba 3.6.18
    cpe:2.3:a:samba:samba:3.6.18
  • Samba 3.6.19
    cpe:2.3:a:samba:samba:3.6.19
  • Samba 3.6.20
    cpe:2.3:a:samba:samba:3.6.20
  • Samba 3.6.21
    cpe:2.3:a:samba:samba:3.6.21
  • Samba 3.6.22
    cpe:2.3:a:samba:samba:3.6.22
  • Samba 3.6.23
    cpe:2.3:a:samba:samba:3.6.23
  • Samba 3.6.24
    cpe:2.3:a:samba:samba:3.6.24
  • Samba 3.6.25
    cpe:2.3:a:samba:samba:3.6.25
  • Samba 4.0.0
    cpe:2.3:a:samba:samba:4.0.0
  • Samba 4.0.1
    cpe:2.3:a:samba:samba:4.0.1
  • Samba 4.0.2
    cpe:2.3:a:samba:samba:4.0.2
  • Samba 4.0.3
    cpe:2.3:a:samba:samba:4.0.3
  • Samba 4.0.4
    cpe:2.3:a:samba:samba:4.0.4
  • Samba 4.0.5
    cpe:2.3:a:samba:samba:4.0.5
  • Samba 4.0.6
    cpe:2.3:a:samba:samba:4.0.6
  • Samba 4.0.7
    cpe:2.3:a:samba:samba:4.0.7
  • Samba 4.0.8
    cpe:2.3:a:samba:samba:4.0.8
  • Samba 4.0.9
    cpe:2.3:a:samba:samba:4.0.9
  • Samba 4.0.10
    cpe:2.3:a:samba:samba:4.0.10
  • Samba 4.0.11
    cpe:2.3:a:samba:samba:4.0.11
  • Samba 4.0.12
    cpe:2.3:a:samba:samba:4.0.12
  • Samba 4.0.13
    cpe:2.3:a:samba:samba:4.0.13
  • Samba 4.0.14
    cpe:2.3:a:samba:samba:4.0.14
  • Samba 4.0.15
    cpe:2.3:a:samba:samba:4.0.15
  • Samba 4.0.16
    cpe:2.3:a:samba:samba:4.0.16
  • Samba 4.0.17
    cpe:2.3:a:samba:samba:4.0.17
  • Samba 4.0.18
    cpe:2.3:a:samba:samba:4.0.18
  • Samba 4.0.19
    cpe:2.3:a:samba:samba:4.0.19
  • Samba 4.0.20
    cpe:2.3:a:samba:samba:4.0.20
  • Samba 4.0.21
    cpe:2.3:a:samba:samba:4.0.21
  • Samba 4.0.22
    cpe:2.3:a:samba:samba:4.0.22
  • Samba 4.0.23
    cpe:2.3:a:samba:samba:4.0.23
  • Samba 4.0.24
    cpe:2.3:a:samba:samba:4.0.24
  • Samba 4.0.25
    cpe:2.3:a:samba:samba:4.0.25
  • Samba 4.0.26
    cpe:2.3:a:samba:samba:4.0.26
  • Samba 4.1.0
    cpe:2.3:a:samba:samba:4.1.0
  • Samba 4.1.1
    cpe:2.3:a:samba:samba:4.1.1
  • Samba 4.1.2
    cpe:2.3:a:samba:samba:4.1.2
  • Samba 4.1.3
    cpe:2.3:a:samba:samba:4.1.3
  • Samba 4.1.4
    cpe:2.3:a:samba:samba:4.1.4
  • Samba 4.1.5
    cpe:2.3:a:samba:samba:4.1.5
  • Samba 4.1.6
    cpe:2.3:a:samba:samba:4.1.6
  • Samba 4.1.7
    cpe:2.3:a:samba:samba:4.1.7
  • Samba 4.1.8
    cpe:2.3:a:samba:samba:4.1.8
  • Samba 4.1.9
    cpe:2.3:a:samba:samba:4.1.9
  • Samba 4.1.10
    cpe:2.3:a:samba:samba:4.1.10
  • Samba 4.1.11
    cpe:2.3:a:samba:samba:4.1.11
  • Samba 4.1.12
    cpe:2.3:a:samba:samba:4.1.12
  • Samba 4.1.13
    cpe:2.3:a:samba:samba:4.1.13
  • Samba 4.1.14
    cpe:2.3:a:samba:samba:4.1.14
  • Samba 4.1.15
    cpe:2.3:a:samba:samba:4.1.15
  • Samba 4.1.16
    cpe:2.3:a:samba:samba:4.1.16
  • Samba 4.1.17
    cpe:2.3:a:samba:samba:4.1.17
  • Samba 4.1.18
    cpe:2.3:a:samba:samba:4.1.18
  • Samba 4.1.19
    cpe:2.3:a:samba:samba:4.1.19
  • Samba 4.1.20
    cpe:2.3:a:samba:samba:4.1.20
  • Samba 4.1.21
    cpe:2.3:a:samba:samba:4.1.21
  • Samba 4.1.22
    cpe:2.3:a:samba:samba:4.1.22
  • Samba 4.1.23
    cpe:2.3:a:samba:samba:4.1.23
  • Samba 4.2.0
    cpe:2.3:a:samba:samba:4.2.0
  • Samba 4.2.0 release candidate 1
    cpe:2.3:a:samba:samba:4.2.0:rc1
  • Samba 4.2.0 release candidate 2
    cpe:2.3:a:samba:samba:4.2.0:rc2
  • Samba 4.2.0 release candidate 3
    cpe:2.3:a:samba:samba:4.2.0:rc3
  • Samba 4.2.0 release candidate 4
    cpe:2.3:a:samba:samba:4.2.0:rc4
  • Samba 4.2.1
    cpe:2.3:a:samba:samba:4.2.1
  • Samba 4.2.2
    cpe:2.3:a:samba:samba:4.2.2
  • Samba 4.2.3
    cpe:2.3:a:samba:samba:4.2.3
  • Samba 4.2.4
    cpe:2.3:a:samba:samba:4.2.4
  • Samba 4.2.5
    cpe:2.3:a:samba:samba:4.2.5
  • Samba 4.2.6
    cpe:2.3:a:samba:samba:4.2.6
  • Samba 4.2.7
    cpe:2.3:a:samba:samba:4.2.7
  • Samba 4.2.8
    cpe:2.3:a:samba:samba:4.2.8
  • Samba 4.2.9
    cpe:2.3:a:samba:samba:4.2.9
  • Samba 4.2.10
    cpe:2.3:a:samba:samba:4.2.10
  • Samba 4.2.11
    cpe:2.3:a:samba:samba:4.2.11
  • Samba 4.2.12
    cpe:2.3:a:samba:samba:4.2.12
  • Samba 4.2.13
    cpe:2.3:a:samba:samba:4.2.13
  • Samba 4.2.14
    cpe:2.3:a:samba:samba:4.2.14
  • Samba 4.3.0
    cpe:2.3:a:samba:samba:4.3.0
  • Samba 4.3.1
    cpe:2.3:a:samba:samba:4.3.1
  • Samba 4.3.2
    cpe:2.3:a:samba:samba:4.3.2
  • Samba 4.3.3
    cpe:2.3:a:samba:samba:4.3.3
  • Samba 4.3.4
    cpe:2.3:a:samba:samba:4.3.4
  • Samba 4.3.5
    cpe:2.3:a:samba:samba:4.3.5
  • Samba 4.3.6
    cpe:2.3:a:samba:samba:4.3.6
  • Samba 4.3.7
    cpe:2.3:a:samba:samba:4.3.7
  • Samba 4.3.8
    cpe:2.3:a:samba:samba:4.3.8
  • Samba 4.3.9
    cpe:2.3:a:samba:samba:4.3.9
  • Samba 4.3.10
    cpe:2.3:a:samba:samba:4.3.10
  • Samba 4.3.11
    cpe:2.3:a:samba:samba:4.3.11
  • Samba 4.3.12
    cpe:2.3:a:samba:samba:4.3.12
  • Samba 4.3.13
    cpe:2.3:a:samba:samba:4.3.13
  • Samba 4.4.0
    cpe:2.3:a:samba:samba:4.4.0
  • Samba 4.4.0 Release Candidate 1
    cpe:2.3:a:samba:samba:4.4.0:rc1
  • Samba 4.4.0 Release Candidate 2
    cpe:2.3:a:samba:samba:4.4.0:rc2
  • Samba 4.4.0 Release Candidate 3
    cpe:2.3:a:samba:samba:4.4.0:rc3
  • Samba 4.4.1
    cpe:2.3:a:samba:samba:4.4.1
  • Samba 4.4.2
    cpe:2.3:a:samba:samba:4.4.2
  • Samba 4.4.3
    cpe:2.3:a:samba:samba:4.4.3
  • Samba 4.4.4
    cpe:2.3:a:samba:samba:4.4.4
  • Samba 4.4.5
    cpe:2.3:a:samba:samba:4.4.5
  • Samba 4.4.6
    cpe:2.3:a:samba:samba:4.4.6
  • Samba 4.4.7
    cpe:2.3:a:samba:samba:4.4.7
  • Samba 4.4.8
    cpe:2.3:a:samba:samba:4.4.8
  • Samba 4.4.9
    cpe:2.3:a:samba:samba:4.4.9
  • Samba 4.4.10
    cpe:2.3:a:samba:samba:4.4.10
  • Samba 4.4.11
    cpe:2.3:a:samba:samba:4.4.11
  • Samba 4.4.12
    cpe:2.3:a:samba:samba:4.4.12
  • Samba 4.4.13
    cpe:2.3:a:samba:samba:4.4.13
  • Samba 4.4.14
    cpe:2.3:a:samba:samba:4.4.14
  • Samba 4.4.15
    cpe:2.3:a:samba:samba:4.4.15
  • Samba 4.4.16
    cpe:2.3:a:samba:samba:4.4.16
  • Samba 4.5.0
    cpe:2.3:a:samba:samba:4.5.0
  • Samba 4.5.0 Release Candidate 1
    cpe:2.3:a:samba:samba:4.5.0:rc1
  • Samba 4.5.0 Release Candidate 2
    cpe:2.3:a:samba:samba:4.5.0:rc2
  • Samba 4.5.0 Release Candidate 3
    cpe:2.3:a:samba:samba:4.5.0:rc3
  • Samba 4.5.1
    cpe:2.3:a:samba:samba:4.5.1
  • Samba 4.5.2
    cpe:2.3:a:samba:samba:4.5.2
  • Samba 4.5.3
    cpe:2.3:a:samba:samba:4.5.3
  • Samba 4.5.4
    cpe:2.3:a:samba:samba:4.5.4
  • Samba 4.5.5
    cpe:2.3:a:samba:samba:4.5.5
  • Samba 4.5.6
    cpe:2.3:a:samba:samba:4.5.6
  • Samba 4.5.7
    cpe:2.3:a:samba:samba:4.5.7
  • Samba 4.5.8
    cpe:2.3:a:samba:samba:4.5.8
  • Samba 4.5.9
    cpe:2.3:a:samba:samba:4.5.9
  • Samba 4.5.10
    cpe:2.3:a:samba:samba:4.5.10
  • Samba 4.5.11
    cpe:2.3:a:samba:samba:4.5.11
  • Samba 4.5.12
    cpe:2.3:a:samba:samba:4.5.12
  • Samba 4.5.13
    cpe:2.3:a:samba:samba:4.5.13
  • Samba 4.5.14
    cpe:2.3:a:samba:samba:4.5.14
  • Samba 4.5.15
    cpe:2.3:a:samba:samba:4.5.15
  • Samba 4.5.16
    cpe:2.3:a:samba:samba:4.5.16
  • Samba 4.6.0
    cpe:2.3:a:samba:samba:4.6.0
  • Samba 4.6.0 Release Candidate 1
    cpe:2.3:a:samba:samba:4.6.0:rc1
  • Samba 4.6.0 Release Candidate 2
    cpe:2.3:a:samba:samba:4.6.0:rc2
  • Samba 4.6.0 Release Candidate 3
    cpe:2.3:a:samba:samba:4.6.0:rc3
  • Samba 4.6.0 Release Candidate 4
    cpe:2.3:a:samba:samba:4.6.0:rc4
  • Samba 4.6.1
    cpe:2.3:a:samba:samba:4.6.1
  • Samba 4.6.2
    cpe:2.3:a:samba:samba:4.6.2
  • Samba 4.6.3
    cpe:2.3:a:samba:samba:4.6.3
  • Samba 4.6.4
    cpe:2.3:a:samba:samba:4.6.4
  • Samba 4.6.5
    cpe:2.3:a:samba:samba:4.6.5
  • Samba 4.6.6
    cpe:2.3:a:samba:samba:4.6.6
  • Samba 4.6.7
    cpe:2.3:a:samba:samba:4.6.7
  • Samba 4.6.8
    cpe:2.3:a:samba:samba:4.6.8
  • Samba 4.6.9
    cpe:2.3:a:samba:samba:4.6.9
  • Samba 4.6.10
    cpe:2.3:a:samba:samba:4.6.10
  • Samba 4.6.11
    cpe:2.3:a:samba:samba:4.6.11
  • Samba 4.6.12
    cpe:2.3:a:samba:samba:4.6.12
  • Samba 4.6.13
    cpe:2.3:a:samba:samba:4.6.13
  • Samba 4.6.14
    cpe:2.3:a:samba:samba:4.6.14
  • Samba 4.6.15
    cpe:2.3:a:samba:samba:4.6.15
  • Samba 4.6.16
    cpe:2.3:a:samba:samba:4.6.16
  • Samba 4.7.0
    cpe:2.3:a:samba:samba:4.7.0
  • Samba 4.7.0 Release Candidate 1
    cpe:2.3:a:samba:samba:4.7.0:rc1
  • Samba 4.7.0 Release Candidate 2
    cpe:2.3:a:samba:samba:4.7.0:rc2
  • Samba 4.7.0 Release Candidate 3
    cpe:2.3:a:samba:samba:4.7.0:rc3
  • Samba 4.7.0 Release Candidate 4
    cpe:2.3:a:samba:samba:4.7.0:rc4
  • Samba 4.7.0 Release Candidate 5
    cpe:2.3:a:samba:samba:4.7.0:rc5
  • Samba 4.7.0 Release Candidate 6
    cpe:2.3:a:samba:samba:4.7.0:rc6
  • Samba 4.7.1
    cpe:2.3:a:samba:samba:4.7.1
  • Samba 4.7.2
    cpe:2.3:a:samba:samba:4.7.2
  • Samba 4.7.3
    cpe:2.3:a:samba:samba:4.7.3
  • Samba 4.7.4
    cpe:2.3:a:samba:samba:4.7.4
  • Samba 4.7.5
    cpe:2.3:a:samba:samba:4.7.5
  • Samba 4.7.6
    cpe:2.3:a:samba:samba:4.7.6
  • Samba 4.7.7
    cpe:2.3:a:samba:samba:4.7.7
  • Samba 4.7.8
    cpe:2.3:a:samba:samba:4.7.8
  • Samba 4.8.4
    cpe:2.3:a:samba:samba:4.8.4
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
  • Canonical Ubuntu Linux 16.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:16.04:-:-:-:lts
  • Canonical Ubuntu Linux 18.04 LTS Edition
    cpe:2.3:o:canonical:ubuntu_linux:18.04:-:-:-:lts
  • RedHat Enterprise Linux Desktop 7.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • RedHat Enterprise Linux Workstation 7.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0
CVSS
Base: 4.3
Impact:
Exploitability:
CWE CWE-255
CAPEC
nessus via4
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_C4E9A4279FC211E8802A000C29A1E3EC.NASL
    description The samba project reports : Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which allows authentication using NTLMv1 over an SMB1 transport (either directory or via NETLOGON SamLogon calls from a member server), even when NTLMv1 is explicitly disabled on the server. Missing input sanitization checks on some of the input parameters to LDB database layer cause the LDAP server and DNS server to crash when following a NULL pointer. Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in libsmbclient that could allow a malicious server to overwrite client heap memory by returning an extra long filename in a directory listing. Missing database output checks on the returned directory attributes from the LDB database layer cause the DsCrackNames call in the DRSUAPI server to crash when following a NULL pointer. All versions of the Samba Active Directory LDAP server from 4.0.0 onwards are vulnerable to the disclosure of confidential attribute values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL (0x80) searchFlags bit and where an explicit Access Control Entry has been specified on the ntSecurityDescriptor.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 111722
    published 2018-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111722
    title FreeBSD : samba -- multiple vulnerabilities (c4e9a427-9fc2-11e8-802a-000c29a1e3ec)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2018-891.NASL
    description This update for samba fixes the following issues : The following security vulnerabilities were fixed : - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't allow it; (bsc#1095048) - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes; (bsc#1095056) - CVE-2018-10919: Confidential attribute disclosure via substring search; (bsc#1095057) - CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow; (bsc#1103411) - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames on a user without a SPN; (bsc#1103414) This update was imported from the SUSE:SLE-15:Update update project.
    last seen 2019-02-21
    modified 2018-11-29
    plugin id 112000
    published 2018-08-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=112000
    title openSUSE Security Update : samba (openSUSE-2018-891)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2018-2318-1.NASL
    description This update for samba fixes the following issues: The following security vulnerabilities were fixed : - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't allow it; (bsc#1095048) - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes; (bsc#1095056) - CVE-2018-10919: Confidential attribute disclosure via substring search; (bsc#1095057) - CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow; (bsc#1103411) - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames on a user without a SPN; (bsc#1103414) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 120077
    published 2019-01-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120077
    title SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:2318-1)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3738-1.NASL
    description Svyatoslav Phirsov discovered that the Samba libsmbclient library incorrectly handled extra long filenames. A malicious server could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-10858) Volker Mauel discovered that Samba incorrectly handled database output. When used as an Active Directory Domain Controller, a remote authenticated attacker could use this issue to cause Samba to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10918) Phillip Kuhrt discovered that the Samba LDAP server incorrectly handled certain confidential attribute values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive information. (CVE-2018-10919) Vivek Das discovered that Samba incorrectly handled NTLMv1 being explicitly disabled on the server. A remote user could possibly be authenticated using NTLMv1, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-1139). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 111748
    published 2018-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111748
    title Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : samba vulnerabilities (USN-3738-1)
  • NASL family Misc.
    NASL id SAMBA_4_6_15.NASL
    description The version of Samba running on the remote host is 4.6.x prior to 4.6.16, or 4.7.x prior to 4.7.9, or 4.8.x prior to 4.8.4. It is, therefore, affected by multiple vulnerabilities.
    last seen 2019-02-21
    modified 2018-12-07
    plugin id 111974
    published 2018-08-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111974
    title 4.6.x < 4.6.16 / 4.7.x < 4.7.9 / 4.8.x < 4.8.4 Multiple Vulnerabilities
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-8E4D871867.NASL
    description Update to Samba 4.7.9, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-02
    plugin id 112051
    published 2018-08-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=112051
    title Fedora 27 : 2:samba (2018-8e4d871867)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2018-1126.NASL
    description A NULL pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash. (CVE-2018-1050) A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. (CVE-2018-10858) A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client. (CVE-2018-1139)
    last seen 2019-02-21
    modified 2019-01-25
    plugin id 121359
    published 2019-01-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=121359
    title Amazon Linux AMI : samba (ALAS-2018-1126)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-BC22D6C7BC.NASL
    description Update to Samba 4.8.4, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120746
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120746
    title Fedora 28 : 2:samba / libldb (2018-bc22d6c7bc)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-2613.NASL
    description Updated samba packages that fix several security issues and provide several bug fixes and an enhancement are now available for Red Hat Gluster Storage 3.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * samba: Weak authentication protocol regression (CVE-2018-1139) * samba: Insufficient input validation in libsmbclient (CVE-2018-10858) * samba: NULL pointer indirection in printer server process (CVE-2018-1050) Red Hat would like to thank the Samba project for reporting CVE-2018-1139 and CVE-2018-1050. Upstream acknowledges Vivek Das (Red Hat) as the original reporter of CVE-2018-1139. For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es) : * Previously, sharing a subdirectory of a Gluster volume failed with an I/O error when the shadow_copy2 vfs object was specified. This occurred because Gluster volumes are remote file systems, and shadow_copy2 only detected share paths in the local file system. This update forces the value of shadow:mountpath to '/', skipping the code related to mount point detection, and preventing this problem. However, this fix requires that the glusterfs vfs object is listed after the shadow_copy2 vfs object in the smb.conf file. (BZ#1379444) * As of Red Hat Gluster Storage 3.4, the libldb package is no longer shipped as an independent package in the Red Hat Gluster Storage Samba channel. The capabilities of the libldb package are now provided by a combination of the samba-client and samba-client-libs packages. In addition, the sub-packages previously provided by libldb are now provided by the samba-client and samba-client-libs packages. The samba-client sub-package provides ldb-tools, and the samba-client-libs sub-package provides pyldb. (BZ# 1592794) Enhancement(s) : * Red Hat Gluster Storage volumes exported using SMB can now be mounted on macOS clients using Finder. Configuration instructions are provided as part of the Red Hat Gluster Storage 3.4 documentation. (BZ#1446125) Red Hat strongly recommends upgrading to these updated packages.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 117320
    published 2018-09-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117320
    title RHEL 7 : Storage Server (RHSA-2018:2613)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20181030_SAMBA_ON_SL7_X.NASL
    description Security Fix(es) : - samba: Weak authentication protocol regression (CVE-2018-1139) - samba: Insufficient input validation in libsmbclient (CVE-2018-10858) - samba: NULL pointer dereference in printer server process (CVE-2018-1050)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 119198
    published 2018-11-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119198
    title Scientific Linux Security Update : samba on SL7.x x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-3056.NASL
    description An update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.8.3). (BZ#1558560) Security Fix(es) : * samba: Weak authentication protocol regression (CVE-2018-1139) * samba: Insufficient input validation in libsmbclient (CVE-2018-10858) * samba: NULL pointer dereference in printer server process (CVE-2018-1050) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the Samba project for reporting CVE-2018-1050. The CVE-2018-1139 issue was discovered by Vivek Das (Red Hat). Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 118519
    published 2018-10-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118519
    title RHEL 7 : samba (RHSA-2018:3056)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2018-3056.NASL
    description An update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.8.3). (BZ#1558560) Security Fix(es) : * samba: Weak authentication protocol regression (CVE-2018-1139) * samba: Insufficient input validation in libsmbclient (CVE-2018-10858) * samba: NULL pointer dereference in printer server process (CVE-2018-1050) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the Samba project for reporting CVE-2018-1050. The CVE-2018-1139 issue was discovered by Vivek Das (Red Hat). Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-12-17
    plugin id 119691
    published 2018-12-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119691
    title CentOS 7 : samba (CESA-2018:3056)
  • NASL family Amazon Linux Local Security Checks
    NASL id AL2_ALAS-2018-1126.NASL
    description A NULL pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash.(CVE-2018-1050) A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client.(CVE-2018-10858) A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.(CVE-2018-1139)
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 119781
    published 2018-12-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=119781
    title Amazon Linux 2 : samba (ALAS-2018-1126)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-2612.NASL
    description Updated samba packages that fix several security issues and provide several bug fixes and an enhancement are now available for Red Hat Gluster Storage 3.4 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es) : * samba: Weak authentication protocol regression (CVE-2018-1139) * samba: Insufficient input validation in libsmbclient (CVE-2018-10858) * samba: NULL pointer indirection in printer server process (CVE-2018-1050) Red Hat would like to thank the Samba project for reporting CVE-2018-1139 and CVE-2018-1050. Upstream acknowledges Vivek Das (Red Hat) as the original reporter of CVE-2018-1139. For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es) : * Previously, sharing a subdirectory of a Gluster volume failed with an I/O error when the shadow_copy2 vfs object was specified. This occurred because Gluster volumes are remote file systems, and shadow_copy2 only detected share paths in the local file system. This update forces the value of shadow:mountpath to '/', skipping the code related to mount point detection, and preventing this problem. However, this fix requires that the glusterfs vfs object is listed after the shadow_copy2 vfs object in the smb.conf file. (BZ#1379444) * As of Red Hat Gluster Storage 3.4, the libldb package is no longer shipped as an independent package in the Red Hat Gluster Storage Samba channel. The capabilities of the libldb package are now provided by a combination of the samba-client and samba-client-libs packages. In addition, the sub-packages previously provided by libldb are now provided by the samba-client and samba-client-libs packages. The samba-client sub-package provides ldb-tools, and the samba-client-libs sub-package provides pyldb. (BZ# 1592794) Enhancement(s) : * Red Hat Gluster Storage volumes exported using SMB can now be mounted on macOS clients using Finder. Configuration instructions are provided as part of the Red Hat Gluster Storage 3.4 documentation. (BZ#1446125) Red Hat strongly recommends upgrading to these updated packages. Disabled on 2018/11/06. Detection of Gluster Storage Server on RHEL 6 is no longer possible due to changes in Gluster package versioning.
    last seen 2019-02-21
    modified 2018-11-07
    plugin id 117319
    published 2018-09-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117319
    title RHEL 6 : Storage Server (RHSA-2018:2612) (deprecated)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-3056.NASL
    description From Red Hat Security Advisory 2018:3056 : An update for samba is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.8.3). (BZ#1558560) Security Fix(es) : * samba: Weak authentication protocol regression (CVE-2018-1139) * samba: Insufficient input validation in libsmbclient (CVE-2018-10858) * samba: NULL pointer dereference in printer server process (CVE-2018-1050) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the Samba project for reporting CVE-2018-1050. The CVE-2018-1139 issue was discovered by Vivek Das (Red Hat). Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.
    last seen 2019-02-21
    modified 2018-11-07
    plugin id 118766
    published 2018-11-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118766
    title Oracle Linux 7 : samba (ELSA-2018-3056)
redhat via4
advisories
  • rhsa
    id RHSA-2018:2612
  • rhsa
    id RHSA-2018:2613
  • rhsa
    id RHSA-2018:3056
rpms
  • libcmocka-0:1.1.1-1.el7
  • libcmocka-devel-0:1.1.1-1.el7
  • libcmocka-static-0:1.1.1-1.el7
  • python-iso8601-0:0.1.11-2.el7
  • ctdb-0:4.8.3-4.el7
  • ctdb-tests-0:4.8.3-4.el7
  • libsmbclient-0:4.8.3-4.el7
  • libsmbclient-devel-0:4.8.3-4.el7
  • libwbclient-0:4.8.3-4.el7
  • libwbclient-devel-0:4.8.3-4.el7
  • samba-0:4.8.3-4.el7
  • samba-client-0:4.8.3-4.el7
  • samba-client-libs-0:4.8.3-4.el7
  • samba-common-0:4.8.3-4.el7
  • samba-common-libs-0:4.8.3-4.el7
  • samba-common-tools-0:4.8.3-4.el7
  • samba-dc-0:4.8.3-4.el7
  • samba-dc-libs-0:4.8.3-4.el7
  • samba-devel-0:4.8.3-4.el7
  • samba-krb5-printing-0:4.8.3-4.el7
  • samba-libs-0:4.8.3-4.el7
  • samba-pidl-0:4.8.3-4.el7
  • samba-python-0:4.8.3-4.el7
  • samba-python-test-0:4.8.3-4.el7
  • samba-test-0:4.8.3-4.el7
  • samba-test-libs-0:4.8.3-4.el7
  • samba-vfs-glusterfs-0:4.8.3-4.el7
  • samba-winbind-0:4.8.3-4.el7
  • samba-winbind-clients-0:4.8.3-4.el7
  • samba-winbind-krb5-locator-0:4.8.3-4.el7
  • samba-winbind-modules-0:4.8.3-4.el7
refmap via4
bid 105084
confirm
ubuntu USN-3738-1
Last major update 22-08-2018 - 10:29
Published 22-08-2018 - 10:29
Last modified 06-11-2018 - 09:07
Back to Top