Critical Input Sanitization Flaw in ldb and samba Packages Leading to Denial of Service
Summary
ALPINE-CVE-2018-1140: A missing input sanitization flaw was found in the implementation of LDP database used for the LDAP server. Affects ldb versions < 1.3.5-r0. Fixed in 1.3.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ldb package is a lightweight database used by the Samba software suite, which provides file and print services for various operating systems. Samba allows for interoperability between Linux/Unix servers and Windows-based clients. The vulnerability in question affects the input sanitization within the ldb database, which is crucial for maintaining the integrity and security of data processed by Samba.
Vulnerability Detail
A missing input sanitization flaw was discovered in the ldb database implementation used by Samba. This vulnerability allows an attacker to exploit the system, potentially leading to a denial of service against a Samba server configured as an Active Directory Domain Controller. The flaw exists in all versions of Samba from 4.8.0 onwards, making it critical for users to address this issue promptly to avoid service disruptions.
How To Fix
Minimum fixed version
1.3.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade ldbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Samba server or disable the LDAP functionality until the packages are updated. This can be done by modifying the Samba configuration file (smb.conf) to disable LDAP support.
Conclusion
The input sanitization flaw in the ldb and samba packages poses a significant risk to users, particularly those running Samba as an Active Directory Domain Controller. It is crucial to apply the necessary updates to protect against potential denial of service attacks and ensure the continued reliability of services.
See every vulnerability recorded for ldb →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to a denial of service, causing interruptions in service for users relying on the Samba server.
Yes, patches are available for both the ldb and samba packages. Users should update to ldb version 1.3.5-r0 and samba version 4.8.4-r0.
Users of affected versions should immediately update their packages to the patched versions to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ldb.
