CVE-2019-12435

samba: AD DC Denial of Service in DNS management server

Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS management server (dnsserver) RPC server process.

CVSS 3.0 · 6.5 Medium EPSS 2.1% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2019-10218

samba: smb client vulnerable to filenames containing path separators

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.

CVSS 3.1 · 6.5 Medium EPSS 3.4% KEV · Not listed

Vendors

Fedoraproject Redhat Samba

Products

Fedora Enterprise Linux Storage and 1 more

CVE-2019-10197

samba: Combination of parameters and permissions can allow user to escape from the share path definition

A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 2 more

CVE-2018-1140

libldb: LDAP server crash via distinguishedName

A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. An attacker could use this flaw to cause a denial of service against a samba server, used as a Active Directory Domain Controller. All versions of Samba from 4.8.0 onwards are vulnerable

CVSS 3.0 · 6.5 Medium EPSS 10.9% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2018-1139

samba: Weak authentication protocol regression

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.

CVSS 3.1 · 8.1 High EPSS 3.1% KEV · Not listed

Vendors

Canonical Redhat Samba

Products

Ubuntu Linux Enterprise Linux Enterprise Linux Desktop and 4 more

CVE-2018-1057

samba: Authenticated users can change other users password in an AD DC configuration

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

CVSS 3.1 · 8.8 High EPSS 10.0% KEV · Not listed

Vendors

Canonical Debian Samba

Products

Ubuntu Linux Debian Linux Samba

CVE-2018-1050

samba: NULL pointer dereference in printer server process

All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.

CVSS 3.1 · 4.3 Medium EPSS 6.5% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 5 more

CVE-2018-16860

samba: S4U2Self with unkeyed checksum

A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Heimdal Project Samba

Products

Heimdal Samba

CVE-2018-16857

samba: Bad password count in AD DC not always effective

Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.

CVSS 3.0 · 7.4 High EPSS 2.3% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2018-16853

samba: S4U2Self crash with MIT KDC build

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command.

CVSS 3.0 · 7.5 High EPSS 3.1% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2018-16852

samba: NULL pointer de-reference in Samba AD DC DNS management server

Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue, merely a denial of service.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Samba

Products

Samba

CVE-2018-16851

samba: NULL pointer de-reference in Samba AD DC LDAP server

Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 3.3% KEV · Not listed

Vendors

Canonical Debian Samba

Products

Ubuntu Linux Debian Linux Samba

CVE-2018-16841

samba: Double-free in Samba AD DC KDC with PKINIT

Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.

CVSS 3.1 · 6.5 Medium EPSS 4.6% KEV · Not listed

Vendors

Canonical Debian Samba

Products

Ubuntu Linux Debian Linux Samba

CVE-2018-14629

samba: Unprivileged adding of CNAME record causing loop in AD LDAP server

A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service.

CVSS 3.0 · 6.5 Medium EPSS 5.2% KEV · Not listed

Vendors

Canonical Debian Samba

Products

Ubuntu Linux Debian Linux Samba

CVE-2018-10919

samba: Confidential attribute disclosure via substring search

The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.

CVSS 3.0 · 4.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Canonical Debian Samba

Products

Ubuntu Linux Debian Linux Samba

CVE-2018-10918

samba: DsCrackNames on a user without an SPN can trigger NULL-pointer de-reference

A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable.

CVSS 3.0 · 5.2 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Samba

Products

Ubuntu Linux Samba

CVE-2018-10858

samba: Insufficient input validation in libsmbclient

A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.

CVSS 3.0 · 4.3 Medium EPSS 4.3% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Enterprise Linux and 7 more

CVE-2017-2619

samba: symlink race permits opening files outside share directory

Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.

CVSS 3.1 · 7.5 High EPSS 11.0% KEV · Not listed

Vendors

Debian Redhat Samba

Products

Debian Linux Enterprise Linux Storage and 1 more

CVE-2017-12163

Samba: Server memory information leak over SMB1

An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker.

CVSS 3.0 · 4.1 Medium EPSS 7.6% KEV · Not listed

Vendors

Debian Redhat Samba

Products

Debian Linux Enterprise Linux Enterprise Linux Desktop and 5 more

CVE-2017-12151

samba: SMB2 connections don't keep encryption across DFS redirects

A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.

CVSS 3.0 · 7.4 High EPSS 4.1% KEV · Not listed

Vendors

Debian Hp Redhat and 1 more

Products

Debian Linux Cifs Server Enterprise Linux and 6 more