Vulnerabilities > CVE-2018-14629 - Infinite Loop vulnerability in multiple products

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
samba
canonical
debian
CWE-835
nessus

Summary

A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service.

Vulnerable Configurations

Part Description Count
Application
Samba
190
OS
Canonical
5
OS
Debian
2

Nessus

  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2018-333-01.NASL
    descriptionNew samba packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id119280
    published2018-11-29
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119280
    titleSlackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2018-333-01)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Slackware Security Advisory 2018-333-01. The text 
    # itself is copyright (C) Slackware Linux, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(119280);
      script_version("1.4");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/24");
    
      script_cve_id("CVE-2018-14629", "CVE-2018-16841", "CVE-2018-16851", "CVE-2018-16852", "CVE-2018-16853", "CVE-2018-16857");
      script_xref(name:"SSA", value:"2018-333-01");
    
      script_name(english:"Slackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2018-333-01)");
      script_summary(english:"Checks for updated package in /var/log/packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Slackware host is missing a security update."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "New samba packages are available for Slackware 14.0, 14.1, 14.2, and
    -current to fix security issues."
      );
      # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.507711
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?c18ee90c"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected samba package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-16857");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:slackware:slackware_linux:samba");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.2");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/11/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/11/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Slackware Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Slackware/release", "Host/Slackware/packages");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("slackware.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Slackware/release")) audit(AUDIT_OS_NOT, "Slackware");
    if (!get_kb_item("Host/Slackware/packages")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Slackware", cpu);
    
    
    flag = 0;
    if (slackware_check(osver:"14.0", pkgname:"samba", pkgver:"4.6.16", pkgarch:"i486", pkgnum:"2_slack14.0")) flag++;
    if (slackware_check(osver:"14.0", arch:"x86_64", pkgname:"samba", pkgver:"4.6.16", pkgarch:"x86_64", pkgnum:"2_slack14.0")) flag++;
    
    if (slackware_check(osver:"14.1", pkgname:"samba", pkgver:"4.6.16", pkgarch:"i486", pkgnum:"2_slack14.1")) flag++;
    if (slackware_check(osver:"14.1", arch:"x86_64", pkgname:"samba", pkgver:"4.6.16", pkgarch:"x86_64", pkgnum:"2_slack14.1")) flag++;
    
    if (slackware_check(osver:"14.2", pkgname:"samba", pkgver:"4.6.16", pkgarch:"i586", pkgnum:"2_slack14.2")) flag++;
    if (slackware_check(osver:"14.2", arch:"x86_64", pkgname:"samba", pkgver:"4.6.16", pkgarch:"x86_64", pkgnum:"2_slack14.2")) flag++;
    
    if (slackware_check(osver:"current", pkgname:"samba", pkgver:"4.9.3", pkgarch:"i586", pkgnum:"1")) flag++;
    if (slackware_check(osver:"current", arch:"x86_64", pkgname:"samba", pkgver:"4.9.3", pkgarch:"x86_64", pkgnum:"1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:slackware_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMisc.
    NASL idSAMBA_4_7_12.NASL
    descriptionThe version of Samba running on the remote host is 4.7.x prior to 4.7.12, or 4.8.x prior to 4.8.7, or 4.9.x prior to 4.9.3. It is, therefore, affected by multiple vulnerabilities. Notes: - Refer to vendor advisories for possible workarounds. - CVE-2018-16852 and CVE-2018-16857 only apply to 4.9.x. Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id119306
    published2018-11-30
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119306
    titleSamba 4.7.x < 4.7.12 / 4.8.x < 4.8.7 / 4.9.x < 4.9.3 Multiple Vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3827-1.NASL
    descriptionFlorian Stuelpner discovered that Samba incorrectly handled CNAME records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2018-14629) Alex MacCuish discovered that Samba incorrectly handled memory when configured to accept smart-card authentication. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2018-16841) Garming Sam discovered that Samba incorrectly handled memory when processing LDAP searches. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2018-16851). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id119254
    published2018-11-28
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119254
    titleUbuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 18.10 : samba vulnerabilities (USN-3827-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-4066-1.NASL
    descriptionThis update for samba fixes the following issues : Update to samba version 4.7.11. Security issues fixed : CVE-2018-14629: Fixed CNAME loops in Samba AD DC DNS server (bsc#1116319). CVE-2018-16841: Fixed segfault on PKINIT when mis-matching principal (bsc#1116320). CVE-2018-16851: Fixed NULL pointer de-reference in Samba AD DC LDAP server (bsc#1116322). CVE-2018-16853: Mark MIT support for the AD DC experimental (bsc#1116324). Non-security issues fixed: Fixed do not take over stderr when there is no log file (bsc#1101499). Fixed ctdb_mutex_ceph_rados_helper deadlock; (bsc#1102230). Fixed ntlm authentications with
    last seen2020-03-18
    modified2019-01-02
    plugin id120184
    published2019-01-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120184
    titleSUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:4066-1)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-202003-52.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code, cause a Denial of Service condition, conduct a man-in-the-middle attack, or obtain sensitive information. Workaround : There is no known workaround at this time.
    last seen2020-03-31
    modified2020-03-26
    plugin id134927
    published2020-03-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134927
    titleGLSA-202003-52 : Samba: Multiple vulnerabilities
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_54976998F24811E881E2005056A311D1.NASL
    descriptionThe samba project reports : All versions of Samba from 4.0.0 onwards are vulnerable to infinite query recursion caused by CNAME loops. Any dns record can be added via ldap by an unprivileged user using the ldbadd tool, so this is a security issue. When configured to accept smart-card authentication, Samba
    last seen2020-06-01
    modified2020-06-02
    plugin id119246
    published2018-11-28
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119246
    titleFreeBSD : samba -- multiple vulnerabilities (54976998-f248-11e8-81e2-005056a311d1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-C2A93F8E1B.NASL
    descriptionUpdate to Samba 4.8.7 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120763
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120763
    titleFedora 28 : 2:samba (2018-c2a93f8e1b)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4345.NASL
    descriptionSeveral vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2018-14629 Florian Stuelpner discovered that Samba is vulnerable to infinite query recursion caused by CNAME loops, resulting in denial of service. https://www.samba.org/samba/security/CVE-2018-14629.html - CVE-2018-16841 Alex MacCuish discovered that a user with a valid certificate or smart card can crash the Samba AD DC
    last seen2020-06-01
    modified2020-06-02
    plugin id119268
    published2018-11-29
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119268
    titleDebian DSA-4345-1 : samba - security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1607.NASL
    descriptionSeveral vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2018-14629 Florian Stuelpner discovered that Samba is vulnerable to infinite query recursion caused by CNAME loops, resulting in denial of service. CVE-2018-16851 Garming Sam of the Samba Team and Catalyst discovered a NULL pointer dereference vulnerability in the Samba AD DC LDAP server allowing a user able to read more than 256MB of LDAP entries to crash the Samba AD DC
    last seen2020-03-28
    modified2018-12-17
    plugin id119694
    published2018-12-17
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119694
    titleDebian DLA-1607-1 : samba security update
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2018-E423E8743F.NASL
    descriptionUpdate to Samba 4.9.3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2019-01-03
    plugin id120862
    published2019-01-03
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120862
    titleFedora 29 : 2:samba (2018-e423e8743f)