Lucene search

K
amazonAmazonALAS-2018-1126
HistoryJan 22, 2019 - 5:55 p.m.

Medium: samba

2019-01-2217:55:00
alas.aws.amazon.com
63

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.027 Low

EPSS

Percentile

90.3%

Issue Overview:

A null pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash. (CVE-2018-1050)

A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. (CVE-2018-10858)

A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client. (CVE-2018-1139)

Affected Packages:

samba

Issue Correction:
Run yum update samba to update your system.

New Packages:

i686:  
    samba-python-test-4.8.3-4.amzn1.i686  
    libsmbclient-4.8.3-4.amzn1.i686  
    samba-libs-4.8.3-4.amzn1.i686  
    samba-devel-4.8.3-4.amzn1.i686  
    samba-test-libs-4.8.3-4.amzn1.i686  
    samba-winbind-krb5-locator-4.8.3-4.amzn1.i686  
    samba-winbind-clients-4.8.3-4.amzn1.i686  
    samba-common-tools-4.8.3-4.amzn1.i686  
    ctdb-4.8.3-4.amzn1.i686  
    samba-winbind-modules-4.8.3-4.amzn1.i686  
    libsmbclient-devel-4.8.3-4.amzn1.i686  
    samba-krb5-printing-4.8.3-4.amzn1.i686  
    samba-debuginfo-4.8.3-4.amzn1.i686  
    samba-4.8.3-4.amzn1.i686  
    samba-python-4.8.3-4.amzn1.i686  
    ctdb-tests-4.8.3-4.amzn1.i686  
    samba-test-4.8.3-4.amzn1.i686  
    libwbclient-devel-4.8.3-4.amzn1.i686  
    samba-client-libs-4.8.3-4.amzn1.i686  
    samba-winbind-4.8.3-4.amzn1.i686  
    samba-common-libs-4.8.3-4.amzn1.i686  
    libwbclient-4.8.3-4.amzn1.i686  
    samba-client-4.8.3-4.amzn1.i686  
  
noarch:  
    samba-common-4.8.3-4.amzn1.noarch  
    samba-pidl-4.8.3-4.amzn1.noarch  
  
src:  
    samba-4.8.3-4.amzn1.src  
  
x86_64:  
    samba-winbind-krb5-locator-4.8.3-4.amzn1.x86_64  
    samba-test-libs-4.8.3-4.amzn1.x86_64  
    samba-winbind-clients-4.8.3-4.amzn1.x86_64  
    samba-winbind-4.8.3-4.amzn1.x86_64  
    libsmbclient-4.8.3-4.amzn1.x86_64  
    samba-python-test-4.8.3-4.amzn1.x86_64  
    samba-python-4.8.3-4.amzn1.x86_64  
    samba-devel-4.8.3-4.amzn1.x86_64  
    libwbclient-devel-4.8.3-4.amzn1.x86_64  
    samba-debuginfo-4.8.3-4.amzn1.x86_64  
    samba-krb5-printing-4.8.3-4.amzn1.x86_64  
    libwbclient-4.8.3-4.amzn1.x86_64  
    samba-common-libs-4.8.3-4.amzn1.x86_64  
    ctdb-tests-4.8.3-4.amzn1.x86_64  
    samba-client-libs-4.8.3-4.amzn1.x86_64  
    samba-client-4.8.3-4.amzn1.x86_64  
    libsmbclient-devel-4.8.3-4.amzn1.x86_64  
    ctdb-4.8.3-4.amzn1.x86_64  
    samba-test-4.8.3-4.amzn1.x86_64  
    samba-4.8.3-4.amzn1.x86_64  
    samba-winbind-modules-4.8.3-4.amzn1.x86_64  
    samba-libs-4.8.3-4.amzn1.x86_64  
    samba-common-tools-4.8.3-4.amzn1.x86_64  

Additional References

Red Hat: CVE-2018-1050, CVE-2018-10858, CVE-2018-1139

Mitre: CVE-2018-1050, CVE-2018-10858, CVE-2018-1139

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.027 Low

EPSS

Percentile

90.3%