Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. A use-after-free flaw was found in the way samba servers handled certain SMB1 requests. An unauthenticated attacker could send specially-crafted SMB1 requests to cause the server to crash or execute arbitrary code...

Man-in-the-Middle (MitM)

samba is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as it was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle...

Remote Code Execution (RCE)

samba is vulnerable to remote code execution RCE attacks. The vulnerability exists as Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition...

Denial Of Service (DoS)

samba is vulnerable denial of service DoS attacks. The vulnerability exists as smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability fdopenatomic infinite loop with high CPU usage and memory consumption due to wrongly handling dangling symlinks...

Remote Code Execution (RCE)

samba is vulnerable to remote code execution. A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could upload a shared library to cause the server to load it and execute arbitrary code as root...

Spoofing And Impersonation

samba is vulnerable to spoofing and impersonation. It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users...

Man-in-the-Middle (MitM)

samba is vulnerable to man-in-the-middle attack. A flaw was found in the way Samba initiated signed DCE/RPC connections. A man-in-the-middle attacker could use this flaw to downgrade the connection to not use signing and therefore impersonate the server...

Denial Of Service (DoS)

samba is vulnerable to denial of service DoS attacks. The vulnerability exists as Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of servi...

Authorization Bypass

samba is vulnerable to authorization bypass. A flaw was found in the way Samba handled ACLs on symbolic links. An authenticated user could use this flaw to gain access to an arbitrary file or directory by overwriting its ACL...

Denial Of Service (DoS)

libldb is vulnerable to denial of service. A denial of service flaw was found in the ldbwildcardcompare function of libldb. A remote attacker could send a specially crafted packet that, when processed by an application using libldb for example the AD LDAP server in Samba, would cause that...

Authorization Bypass

samba is vulnerable to authorization bypas. An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path...

Click Jacking

Samba is vulnerable to click-jacking attack. The attack exists because the Samba Web Administration Tool SWAT did not protect against being opened in a web page frame, allowing SWAT users or users with active session to trigger attack...

Bypass Access Restriction

Samba is vulnerable to bypass access restriction. The winbindnamelisttosidstringlist function in nsswitch/pamwinbind.c allows any user's authentication by leveraging an administrator's pamwinbind configuration-file mistake...

Denial Of Service (DoS)

samba is vulnerable to denial of service DoS attacks. The vulnerability exists as the sysrecvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service infinite loop and CPU consumption via a malformed UDP...

Denial Of Service (DoS)

samba is vulnerable to denial of service. An integer overflow vulnerability allows an attacker to send a malicious Extended Attribute EA list to cause the server to utilize excessive amount of memory to loop and reprocess the list Samba, potentially crashing the process...

Authorization Bypass

samba is vulnerable to authorization bypass attacks. The vulnerabiltiy exists as the 1 CreateAccount, 2 OpenAccount, 3 AddAccountRights, and 4 RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict...

Samba AD DC Null Pointer Dereference (CVE-2018-1140)

A null pointer dereference vulnerability exists in Samba. The vulnerability is due to insufficient validation of DNS requests when Samba is operating as an Active Directory Domain Controller. Successful exploitation results in a crash leading to denial of service conditions...

MGASA-2019-0011 Updated ldb, talloc, and samba packages fix security vulnerabilities

Florian Stuelpner discovered that Samba is vulnerable to infinite query recursion caused by CNAME loops, resulting in denial of service CVE-2018-14629. Alex MacCuish discovered that a user with a valid certificate or smart card can crash the Samba AD DC's KDC when configured to accept smart-card...

Updated ldb, talloc, and samba packages fix security vulnerabilities

Florian Stuelpner discovered that Samba is vulnerable to infinite query recursion caused by CNAME loops, resulting in denial of service CVE-2018-14629. Alex MacCuish discovered that a user with a valid certificate or smart card can crash the Samba AD DC's KDC when configured to accept smart-card...

Fedora 28 : 1:libreoffice (2018-8d3f4d7b28)

CVE-2018-10583 A LibreOffice document with a linked image, which is on a samba share, will cause LibreOffice to automatically initiate a samba connection to retrieve the image. This is by design. If end users or administrators wish to disable this functionality this can now be disabled via...