Lucene search
AmazonALAS2-2018-1126HistoryDec 13, 2018 - 8:13 p.m.
Medium: samba
2018-12-1320:13:00
alas.aws.amazon.com
18
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.027 Low
EPSS
Percentile
90.4%
Issue Overview:
A null pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash.(CVE-2018-1050)
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client.(CVE-2018-10858)
A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.(CVE-2018-1139)
Affected Packages:
samba
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update samba to update your system.
New Packages:
aarch64:
samba-4.8.3-4.amzn2.0.1.aarch64
samba-client-4.8.3-4.amzn2.0.1.aarch64
samba-client-libs-4.8.3-4.amzn2.0.1.aarch64
samba-common-libs-4.8.3-4.amzn2.0.1.aarch64
samba-common-tools-4.8.3-4.amzn2.0.1.aarch64
samba-dc-4.8.3-4.amzn2.0.1.aarch64
samba-dc-libs-4.8.3-4.amzn2.0.1.aarch64
samba-devel-4.8.3-4.amzn2.0.1.aarch64
samba-krb5-printing-4.8.3-4.amzn2.0.1.aarch64
samba-libs-4.8.3-4.amzn2.0.1.aarch64
libsmbclient-4.8.3-4.amzn2.0.1.aarch64
libsmbclient-devel-4.8.3-4.amzn2.0.1.aarch64
libwbclient-4.8.3-4.amzn2.0.1.aarch64
libwbclient-devel-4.8.3-4.amzn2.0.1.aarch64
samba-python-4.8.3-4.amzn2.0.1.aarch64
samba-python-test-4.8.3-4.amzn2.0.1.aarch64
samba-test-4.8.3-4.amzn2.0.1.aarch64
samba-test-libs-4.8.3-4.amzn2.0.1.aarch64
samba-winbind-4.8.3-4.amzn2.0.1.aarch64
samba-winbind-clients-4.8.3-4.amzn2.0.1.aarch64
samba-winbind-krb5-locator-4.8.3-4.amzn2.0.1.aarch64
samba-winbind-modules-4.8.3-4.amzn2.0.1.aarch64
ctdb-4.8.3-4.amzn2.0.1.aarch64
ctdb-tests-4.8.3-4.amzn2.0.1.aarch64
samba-debuginfo-4.8.3-4.amzn2.0.1.aarch64
i686:
samba-4.8.3-4.amzn2.0.1.i686
samba-client-4.8.3-4.amzn2.0.1.i686
samba-client-libs-4.8.3-4.amzn2.0.1.i686
samba-common-libs-4.8.3-4.amzn2.0.1.i686
samba-common-tools-4.8.3-4.amzn2.0.1.i686
samba-dc-4.8.3-4.amzn2.0.1.i686
samba-dc-libs-4.8.3-4.amzn2.0.1.i686
samba-devel-4.8.3-4.amzn2.0.1.i686
samba-krb5-printing-4.8.3-4.amzn2.0.1.i686
samba-libs-4.8.3-4.amzn2.0.1.i686
libsmbclient-4.8.3-4.amzn2.0.1.i686
libsmbclient-devel-4.8.3-4.amzn2.0.1.i686
libwbclient-4.8.3-4.amzn2.0.1.i686
libwbclient-devel-4.8.3-4.amzn2.0.1.i686
samba-python-4.8.3-4.amzn2.0.1.i686
samba-python-test-4.8.3-4.amzn2.0.1.i686
samba-test-4.8.3-4.amzn2.0.1.i686
samba-test-libs-4.8.3-4.amzn2.0.1.i686
samba-winbind-4.8.3-4.amzn2.0.1.i686
samba-winbind-clients-4.8.3-4.amzn2.0.1.i686
samba-winbind-krb5-locator-4.8.3-4.amzn2.0.1.i686
samba-winbind-modules-4.8.3-4.amzn2.0.1.i686
ctdb-4.8.3-4.amzn2.0.1.i686
ctdb-tests-4.8.3-4.amzn2.0.1.i686
samba-debuginfo-4.8.3-4.amzn2.0.1.i686
noarch:
samba-common-4.8.3-4.amzn2.0.1.noarch
samba-pidl-4.8.3-4.amzn2.0.1.noarch
src:
samba-4.8.3-4.amzn2.0.1.src
x86_64:
samba-4.8.3-4.amzn2.0.1.x86_64
samba-client-4.8.3-4.amzn2.0.1.x86_64
samba-client-libs-4.8.3-4.amzn2.0.1.x86_64
samba-common-libs-4.8.3-4.amzn2.0.1.x86_64
samba-common-tools-4.8.3-4.amzn2.0.1.x86_64
samba-dc-4.8.3-4.amzn2.0.1.x86_64
samba-dc-libs-4.8.3-4.amzn2.0.1.x86_64
samba-devel-4.8.3-4.amzn2.0.1.x86_64
samba-vfs-glusterfs-4.8.3-4.amzn2.0.1.x86_64
samba-krb5-printing-4.8.3-4.amzn2.0.1.x86_64
samba-libs-4.8.3-4.amzn2.0.1.x86_64
libsmbclient-4.8.3-4.amzn2.0.1.x86_64
libsmbclient-devel-4.8.3-4.amzn2.0.1.x86_64
libwbclient-4.8.3-4.amzn2.0.1.x86_64
libwbclient-devel-4.8.3-4.amzn2.0.1.x86_64
samba-python-4.8.3-4.amzn2.0.1.x86_64
samba-python-test-4.8.3-4.amzn2.0.1.x86_64
samba-test-4.8.3-4.amzn2.0.1.x86_64
samba-test-libs-4.8.3-4.amzn2.0.1.x86_64
samba-winbind-4.8.3-4.amzn2.0.1.x86_64
samba-winbind-clients-4.8.3-4.amzn2.0.1.x86_64
samba-winbind-krb5-locator-4.8.3-4.amzn2.0.1.x86_64
samba-winbind-modules-4.8.3-4.amzn2.0.1.x86_64
ctdb-4.8.3-4.amzn2.0.1.x86_64
ctdb-tests-4.8.3-4.amzn2.0.1.x86_64
samba-debuginfo-4.8.3-4.amzn2.0.1.x86_64
Additional References
Red Hat: CVE-2018-1050, CVE-2018-10858, CVE-2018-1139
Mitre: CVE-2018-1050, CVE-2018-10858, CVE-2018-1139
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 2 | aarch64 | samba | < 4.8.3-4.amzn2.0.1 | samba-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-client | < 4.8.3-4.amzn2.0.1 | samba-client-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-client-libs | < 4.8.3-4.amzn2.0.1 | samba-client-libs-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-common-libs | < 4.8.3-4.amzn2.0.1 | samba-common-libs-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-common-tools | < 4.8.3-4.amzn2.0.1 | samba-common-tools-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-dc | < 4.8.3-4.amzn2.0.1 | samba-dc-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-dc-libs | < 4.8.3-4.amzn2.0.1 | samba-dc-libs-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-devel | < 4.8.3-4.amzn2.0.1 | samba-devel-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-krb5-printing | < 4.8.3-4.amzn2.0.1 | samba-krb5-printing-4.8.3-4.amzn2.0.1.aarch64.rpm |
| Amazon Linux | 2 | aarch64 | samba-libs | < 4.8.3-4.amzn2.0.1 | samba-libs-4.8.3-4.amzn2.0.1.aarch64.rpm |
Related
nessus
nessus
RHEL 6 : Storage Server (RHSA-2018:2612) (deprecated)
2018-09-06 00:00:00
Oracle Linux 7 : samba (ELSA-2018-3056)
2018-11-07 00:00:00
Scientific Linux Security Update : samba on SL7.x x86_64 (20181030)
2018-11-27 00:00:00
centos
centos
ctdb, libsmbclient, libwbclient, samba security update
2018-12-14 16:36:48
libsmbclient, samba security update
2018-06-21 11:56:04
samba4 security update
2018-06-21 11:56:05
redhat
redhat
(RHSA-2018:3056) Moderate: samba security, bug fix, and enhancement update
2018-10-30 04:13:40
(RHSA-2018:2613) Moderate: samba security, bug fix and enhancement update
2018-09-04 06:19:22
(RHSA-2018:2612) Moderate: samba security, bug fix and enhancement update
2018-09-04 06:19:17
oraclelinux
oraclelinux
samba security, bug fix, and enhancement update
2018-11-05 00:00:00
samba4 security and bug fix update
2018-06-25 00:00:00
samba security and bug fix update
2018-06-25 00:00:00
amazon
amazon
Medium: samba
2019-01-22 17:55:00
ibm
ibm
Security Bulletin: IBM QRadar SIEM is vulnerable to Publicly disclosed Samba vulnerabilities (CVE-2018-10858, CVE-2018-1139)
2019-03-05 18:15:01
Security Bulletin: A vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2018-10858)
2018-10-30 07:40:02
Security Bulletin: Multiple Vulnerabilities in Samba affect IBM i
2019-12-18 14:26:38
openvas
openvas
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2019-1125)
2020-01-23 00:00:00
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2019-1150)
2020-01-23 00:00:00
Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2019-1342)
2020-01-23 00:00:00
fedora
fedora
[SECURITY] Fedora 28 Update: samba-4.8.4-0.fc28
2018-08-20 18:43:27
[SECURITY] Fedora 27 Update: samba-4.7.9-0.fc27
2018-08-22 00:46:40
[SECURITY] Fedora 28 Update: libldb-1.4.0-3.fc28.1.3.5
2018-08-20 18:43:27
ubuntu
ubuntu
Samba vulnerabilities
2018-08-14 00:00:00
Samba vulnerability
2018-03-23 00:00:00
Samba vulnerabilities
2018-03-13 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 8 package samba version 4.7.9-alt1
2018-08-15 00:00:00
Security fix for the ALT Linux 8 package samba-DC version 4.7.9-alt1
2018-08-15 00:00:00
Security fix for the ALT Linux 10 package samba version 4.8.4-alt1.S1
2018-08-14 00:00:00
cve
cve
alpinelinux
alpinelinux
prion
prion
Heap overflow
2018-08-22 17:29:00
Design/Logic Flaw
2018-08-22 14:29:00
Design/Logic Flaw
2018-03-13 16:29:00
debiancve
debiancve
samba
samba
Insufficient input validation on client directory
2018-08-14 00:00:00
Denial of Service Attack on external print server.
2018-03-13 00:00:00
Weak authentication protocol allowed.
2018-08-14 00:00:00
veracode
veracode
Arbitrary Code Execution
2019-05-16 03:25:40
Denial Of Service (DoS)
2019-01-15 09:23:30
Man-in-the-Middle (MitM)
2019-05-16 03:25:40
osv
osv
CVE-2018-10858
2018-08-22 17:29:00
CVE-2018-1139
2018-08-22 14:29:00
samba - security update
2018-03-27 00:00:00
suse
suse
Security update for samba (important)
2018-08-17 12:07:57
Security update for samba (important)
2018-08-17 12:12:13
redhatcve
redhatcve
ubuntucve
ubuntucve
cisa
cisa
Samba Releases Security Updates
2018-08-14 00:00:00
Samba Releases Security Updates
2018-03-13 00:00:00
freebsd
freebsd
samba -- multiple vulnerabilities
2018-08-14 00:00:00
samba -- multiple vulnerabilities
2018-01-03 00:00:00
checkpoint_advisories
checkpoint_advisories
Samba Printer Server spoolss Denial Of Service (CVE-2018-1050)
2018-06-03 00:00:00
debian
debian
[SECURITY] [DLA 1320-1] samba security update
2018-03-27 22:36:20
[SECURITY] [DSA 4271-1] samba security update
2018-08-14 10:16:04
[SECURITY] [DSA 4271-1] samba security update
2018-08-14 10:16:04
f5
f5
K01494912 : Samba vulnerability CVE-2018-1050
2020-12-17 00:00:00
cbl_mariner
cbl_mariner
CVE-2018-1050 affecting package samba 4.12.5-4
2024-04-19 05:06:55
slackware
slackware
[slackware-security] samba
2018-08-17 17:43:54
mageia
mageia
Updated samba packages fix security vulnerabilities
2018-10-30 21:01:43
Updated samba packages fix security vulnerabilities
2018-04-13 23:08:48
archlinux
archlinux
[ASA-201803-10] samba: multiple issues
2018-03-13 00:00:00
thn
thn
threatpost
threatpost
Samba Patches Two Critical Vulnerabilities in Server Software
2018-03-13 12:56:17
gentoo
gentoo
Samba: Multiple vulnerabilities
2018-05-22 00:00:00
Samba: Multiple vulnerabilities
2020-03-25 00:00:00
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8 High
AI Score
Confidence
Low
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.027 Low
EPSS
Percentile
90.4%
Related for ALAS2-2018-1126