The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.

The remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code, cause a Denial       of Service condition, conduct a man-in-the-middle attack, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The Samba Active Directory LDAP server was vulnerable     to an information disclosure flaw because of missing     access control checks. An authenticated attacker could     use this flaw to extract confidential attribute values     using LDAP search expressions. Samba versions before     4.6.16, 4.7.9 and 4.8.4 are vulnerable.(CVE-2018-10919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

The following security vulnerabilities were fixed :

  - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't     allow it; (bsc#1095048)

  - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and     DNS query with escapes crashes; (bsc#1095056)

  - CVE-2018-10919: Confidential attribute disclosure via     substring search; (bsc#1095057)

  - CVE-2018-10858: smbc_urlencode helper function is a     subject to buffer overflow; (bsc#1103411)

  - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames     on a user without a SPN; (bsc#1103414)

This update was imported from the SUSE:SLE-15:Update update project.

Update to Samba 4.8.4, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues: The following security vulnerabilities were fixed :

  - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't     allow it; (bsc#1095048)

  - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and     DNS query with escapes crashes; (bsc#1095056)

  - CVE-2018-10919: Confidential attribute disclosure via     substring search; (bsc#1095057)

  - CVE-2018-10858: smbc_urlencode helper function is a     subject to buffer overflow; (bsc#1103411)

  - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames     on a user without a SPN; (bsc#1103414)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Samba was updated to 4.6.15, bringing bug and security fixes.
(bsc#1110943)

Following security issues were fixed :

  - CVE-2018-10919: Fix unauthorized attribute access via     searches. (bsc#1095057);

Non-security bugs fixed :

  - Fix ctdb_mutex_ceph_rados_helper deadlock (bsc#1102230).

  - Allow idmap_rid to have primary group other than 'Domain     Users' (bsc#1087931).

  - winbind: avoid using fstrcpy in _dual_init_connection.

  - Fix ntlm authentications with 'winbind use default     domain = yes' (bsc#1068059).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

Samba was updated to 4.6.15, bringing bug and security fixes.
(bsc#1110943)

Following security issues were fixed :

CVE-2018-10919: Fix unauthorized attribute access via searches.
(bsc#1095057);

Non-security bugs fixed: Fix ctdb_mutex_ceph_rados_helper deadlock (bsc#1102230).

Allow idmap_rid to have primary group other than 'Domain Users' (bsc#1087931).

winbind: avoid using fstrcpy in _dual_init_connection.

Fix ntlm authentications with 'winbind use default domain = yes' (bsc#1068059).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.7.9, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New samba packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The version of Samba running on the remote host is 4.6.x prior to 4.6.16, or 4.7.x prior to 4.7.9, or 4.8.x prior to 4.8.4. It is, therefore, affected by multiple vulnerabilities.

Svyatoslav Phirsov discovered that the Samba libsmbclient library incorrectly handled extra long filenames. A malicious server could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-10858)

Volker Mauel discovered that Samba incorrectly handled database output. When used as an Active Directory Domain Controller, a remote authenticated attacker could use this issue to cause Samba to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10918)

Phillip Kuhrt discovered that the Samba LDAP server incorrectly handled certain confidential attribute values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive information. (CVE-2018-10919)

Vivek Das discovered that Samba incorrectly handled NTLMv1 being explicitly disabled on the server. A remote user could possibly be authenticated using NTLMv1, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-1139).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The samba project reports :

Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which allows authentication using NTLMv1 over an SMB1 transport (either directory or via NETLOGON SamLogon calls from a member server), even when NTLMv1 is explicitly disabled on the server.

Missing input sanitization checks on some of the input parameters to LDB database layer cause the LDAP server and DNS server to crash when following a NULL pointer.

Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in libsmbclient that could allow a malicious server to overwrite client heap memory by returning an extra long filename in a directory listing.

Missing database output checks on the returned directory attributes from the LDB database layer cause the DsCrackNames call in the DRSUAPI server to crash when following a NULL pointer.

All versions of the Samba Active Directory LDAP server from 4.0.0 onwards are vulnerable to the disclosure of confidential attribute values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL (0x80) searchFlags bit and where an explicit Access Control Entry has been specified on the ntSecurityDescriptor.

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2018-10858     Svyatoslav Phirsov discovered that insufficient input     validation in libsmbclient allowed a malicious Samba     server to write to the client's heap memory.

  - CVE-2018-10919     Phillip Kuhrt discovered that Samba when acting as an     Active Domain controller disclosed some sensitive     attributes.

ID	Name	Product	Family	Severity
134927	GLSA-202003-52 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
131637	EulerOS 2.0 SP2 : samba (EulerOS-SA-2019-2484)	Nessus	Huawei Local Security Checks	medium
123268	openSUSE Security Update : samba (openSUSE-2019-617)	Nessus	SuSE Local Security Checks	high
120746	Fedora 28 : 2:samba / libldb (2018-bc22d6c7bc)	Nessus	Fedora Local Security Checks	high
120077	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:2318-1)	Nessus	SuSE Local Security Checks	high
118196	openSUSE Security Update : samba (openSUSE-2018-1195)	Nessus	SuSE Local Security Checks	medium
118172	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2018:3161-1)	Nessus	SuSE Local Security Checks	medium
112051	Fedora 27 : 2:samba (2018-8e4d871867)	Nessus	Fedora Local Security Checks	high
112000	openSUSE Security Update : samba (openSUSE-2018-891)	Nessus	SuSE Local Security Checks	high
111996	Slackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2018-229-02)	Nessus	Slackware Local Security Checks	high
111974	4.6.x < 4.6.16 / 4.7.x < 4.7.9 / 4.8.x < 4.8.4 Multiple Vulnerabilities	Nessus	Misc.	high
111748	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Samba vulnerabilities (USN-3738-1)	Nessus	Ubuntu Local Security Checks	high
111722	FreeBSD : samba -- multiple vulnerabilities (c4e9a427-9fc2-11e8-802a-000c29a1e3ec)	Nessus	FreeBSD Local Security Checks	high
111706	Debian DSA-4271-1 : samba - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10919

medium

Tenable Plugins

critical

medium

high

high

high

medium

medium

high

high

high

high

high

high

high