CVE-2018-1050

All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.

All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.

All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.

• CVE-2019-3880: Refuse winreg SaveKey/RestoreKey RPCs to prevent writing registry hive files outside intended share boundaries via symlink races
• CVE-2019-10218: Reject server-supplied filenames containing path separators in SMB1 directory listings to protect libsmbclient consumers from path traversal attacks
• CVE-2018-1050: Already fixed - upstream patch 0207 applied since the initial import
• CVE-2019-3824: Not affected - the vulnerable ldb_tdb / AD DC code lives in source4, which is not built by this spec (samba_source = source3)

It was discovered that Samba is prone to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon (CVE-2018-1050).

Bjoern Baumbach from Sernet discovered that on Samba 4 AD DC the LDAP server incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users passwords, including administrative users (CVE-2018-1057).

Note that Mageia 5 was only affected by the CVE-2018-1050 issue.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

Samba was updated to version 4.6.13 to fix several bugs. (bsc#1084191)

Security issue fixed:

• CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally (bsc#1081741).

The library talloc was updated to version 2.1.10:

• build, documentation and python3 improvements

The library tevent was updated to version 0.9.34 (bsc#1069666);

• Remove unused select backend
• Fix a race condition in tevent_threaded_schedule_immediate(); (bso#13130);
• make tevent_req_print() more robust against crashes
• Fix mutex locking in tevent_threaded_context_destructor().
• Re-init threading in tevent_re_initialise().
• Include the finish location in tevent_req_default_print().

This update for samba fixes the following issues:

• CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally (bsc#1081741)

This update for samba fixes the following issues:

• CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally (bsc#1081741)

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2018-1050: Fixed denial of service vulnerability when SPOOLSS is run externally (bsc#1081741).
• CVE-2017-14746: Fixed use-after-free vulnerability (bsc#1060427).
• CVE-2017-15275: Fixed server heap memory information leak (bsc#1063008).
• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

Bug fixes:

• bsc#1027593: Update 'winbind expand groups' doc in smb.conf man page.

This update for samba fixes the following issues:

The following security issues were fixed:

• CVE-2018-1050: Fixed denial of service vulnerability when SPOOLSS is run externally (bsc#1081741).
• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

This update for samba fixes the following issues:

The following security issues were fixed:

• CVE-2018-1050: Fixed denial of service vulnerability when SPOOLSS is run externally (bsc#1081741).
• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

Björn Baumbach discovered that Samba incorrectly validated permissions when changing account passwords via LDAP. An authenticated attacker could use this issue to change the password of other users, including administrators, and perform actions as those users. (CVE-2018-1057)

It was discovered that Samba incorrectly validated inputs to the RPC spoolss service. An authenticated attacker could use this issue to cause the service to crash, resulting in a denial of service. (CVE-2018-1050)