CVE-2018-10858

A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.

A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.

Updated samba packages fix security vulnerabilities:

A malicious server could return a directory entry that could corrupt libsmbclient memory (CVE-2018-10858).

Missing access control checks allow discovery of confidential attribute values via authenticated LDAP search expressions (CVE-2018-10919).

The samba package has been updated to version 4.6.16, fixing these issues and other bugs.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

The following security vulnerabilities were fixed:

• CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't allow it; (bsc#1095048)
• CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes; (bsc#1095056)
• CVE-2018-10919: Confidential attribute disclosure via substring search; (bsc#1095057)
• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow; (bsc#1103411)
• CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames on a user without a SPN; (bsc#1103414)

This update for samba fixes the following issues:

The following security vulnerability was fixed:

• CVE-2018-10858: Fixed insufficient input validation on client directory listing in libsmbclient; (bsc#1103411);

The following other change was made:

• s3: winbind: Fix 'winbind normalize names' in wb_getpwsid();
• winbind: honor 'winbind use default domain' with empty domain (bsc#1087303)
• winbind: do not modify credentials in NTLM passthru (bsc#1068059)
• net: fix net ads keytab handling (bsc#1067700)
• fix vfs_ceph flock stub

This update for samba fixes the following issues:

The following security vulnerability was fixed:

• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

The following other bugs were fixed:

• Fix libnss_wins.so.2 link libreplace with rpath (bsc#1054849)

This update for samba fixes the following issues:

The following security vulnerability was fixed:

• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

The following other bugs were fixed:

• Fix libnss_wins.so.2 link libreplace with rpath (bsc#1054849)

This update for samba fixes the following issues:

Security issues fixed:

• CVE-2018-1050: Fixed denial of service vulnerability when SPOOLSS is run externally (bsc#1081741).
• CVE-2017-14746: Fixed use-after-free vulnerability (bsc#1060427).
• CVE-2017-15275: Fixed server heap memory information leak (bsc#1063008).
• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

Bug fixes:

• bsc#1027593: Update 'winbind expand groups' doc in smb.conf man page.

This update for samba fixes the following issues:

The following security issues were fixed:

• CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient (bsc#1103411).

The following other bugs were fixed:

• s3:winbindd: allow a fallback to NTLMSSP for LDAP connections (bsc#1079449)

This update for samba fixes the following issues:

The following security issues were fixed:

• CVE-2018-1050: Fixed denial of service vulnerability when SPOOLSS is run externally (bsc#1081741).
• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

This update for samba fixes the following issues:

The following security issues were fixed:

• CVE-2018-1050: Fixed denial of service vulnerability when SPOOLSS is run externally (bsc#1081741).
• CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

Svyatoslav Phirsov discovered that the Samba libsmbclient library incorrectly handled extra long filenames. A malicious server could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-10858)

Volker Mauel discovered that Samba incorrectly handled database output. When used as an Active Directory Domain Controller, a remote authenticated attacker could use this issue to cause Samba to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10918)

Phillip Kuhrt discovered that the Samba LDAP server incorrectly handled certain confidential attribute values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive information. (CVE-2018-10919)

Vivek Das discovered that Samba incorrectly handled NTLMv1 being explicitly disabled on the server. A remote user could possibly be authenticated using NTLMv1, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-1139)