Critical Null Pointer Dereference in Samba Package - CVE-2018-10918
Summary
ALPINE-CVE-2018-10918: A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. Affects samba versions < 4.8.4-r0. Fixed in 4.8.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Samba is an open-source software suite that provides seamless file and print services to SMB/CIFS clients. It allows for interoperability between Linux/Unix servers and Windows-based clients. Samba is widely used in enterprise environments to facilitate file sharing and printer access across different operating systems. However, certain versions of Samba are vulnerable to a null pointer dereference flaw that can lead to server crashes, particularly in Active Directory Domain Controller configurations.
Vulnerability Detail
The vulnerability identified as CVE-2018-10918 is a null pointer dereference flaw found in Samba's handling of database outputs from the LDB database layer. This issue allows an authenticated attacker to exploit the flaw, potentially causing the Samba server to crash. The vulnerability affects Samba versions prior to 4.7.9 and 4.8.4. The ramifications of this flaw can lead to service disruptions in environments relying on Samba for file and print services, particularly in Active Directory setups.
How To Fix
Minimum fixed version
4.8.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade sambaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
CVE-2018-10918 is a significant vulnerability affecting Samba, which can lead to server crashes in Active Directory configurations. It is essential for users to update to the patched version to ensure the security and stability of their systems. Regular monitoring for vulnerabilities using tools like Vulert can help maintain awareness and prompt action.
See every vulnerability recorded for samba →
FAQ
CVE-2018-10918 is a vulnerability in Samba that allows for a null pointer dereference, potentially crashing the server.
Samba versions prior to 4.7.9 and 4.8.4 are vulnerable to this issue.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2018-10918 is 6.5, indicating a medium severity level.
While there are no specific workarounds, it is crucial to prioritize updating to the patched version to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for samba.
