Alpine: samba: security update to 4.6.16-r2

medium Tenable Cloud Security Plugin ID 407110

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and
4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could
create such an entry, leading to denial of service. (CVE-2018-14629)

- Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of
service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on
the same memory if the principal in a validly signed certificate does not match the principal in the AS-
REQ. This is only possible after authentication with a trusted certificate. talloc is robust against
further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC
process. (CVE-2018-16841)

- Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service.
During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the
entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the
Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is
no further vulnerability associated with this issue, merely a denial of service. (CVE-2018-16851)

Plugin Details

Severity: Medium

ID: 407110

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS Score Source: CVE-2018-16851

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 11/27/2018

Reference Information

CVE: CVE-2018-14629, CVE-2018-16841, CVE-2018-16851

BID: 106022, 106023, 106027

IAVA: 2018-A-0384-S

Detections

Analytics