Vulnerabilities > CVE-2018-16841 - Double Free vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1780.NASL description According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A double-free was found when Samba last seen 2020-05-03 modified 2019-07-25 plugin id 127017 published 2019-07-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127017 title EulerOS 2.0 SP8 : samba (EulerOS-SA-2019-1780) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2018-333-01.NASL description New samba packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 119280 published 2018-11-29 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119280 title Slackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2018-333-01) NASL family Misc. NASL id SAMBA_4_7_12.NASL description The version of Samba running on the remote host is 4.7.x prior to 4.7.12, or 4.8.x prior to 4.8.7, or 4.9.x prior to 4.9.3. It is, therefore, affected by multiple vulnerabilities. Notes: - Refer to vendor advisories for possible workarounds. - CVE-2018-16852 and CVE-2018-16857 only apply to 4.9.x. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 119306 published 2018-11-30 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119306 title Samba 4.7.x < 4.7.12 / 4.8.x < 4.8.7 / 4.9.x < 4.9.3 Multiple Vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-3827-1.NASL description Florian Stuelpner discovered that Samba incorrectly handled CNAME records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2018-14629) Alex MacCuish discovered that Samba incorrectly handled memory when configured to accept smart-card authentication. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2018-16841) Garming Sam discovered that Samba incorrectly handled memory when processing LDAP searches. A remote attacker could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2018-16851). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 119254 published 2018-11-28 reporter Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119254 title Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 18.10 : samba vulnerabilities (USN-3827-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2018-4066-1.NASL description This update for samba fixes the following issues : Update to samba version 4.7.11. Security issues fixed : CVE-2018-14629: Fixed CNAME loops in Samba AD DC DNS server (bsc#1116319). CVE-2018-16841: Fixed segfault on PKINIT when mis-matching principal (bsc#1116320). CVE-2018-16851: Fixed NULL pointer de-reference in Samba AD DC LDAP server (bsc#1116322). CVE-2018-16853: Mark MIT support for the AD DC experimental (bsc#1116324). Non-security issues fixed: Fixed do not take over stderr when there is no log file (bsc#1101499). Fixed ctdb_mutex_ceph_rados_helper deadlock; (bsc#1102230). Fixed ntlm authentications with last seen 2020-03-18 modified 2019-01-02 plugin id 120184 published 2019-01-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120184 title SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:4066-1) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-202003-52.NASL description The remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code, cause a Denial of Service condition, conduct a man-in-the-middle attack, or obtain sensitive information. Workaround : There is no known workaround at this time. last seen 2020-03-31 modified 2020-03-26 plugin id 134927 published 2020-03-26 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134927 title GLSA-202003-52 : Samba: Multiple vulnerabilities NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_54976998F24811E881E2005056A311D1.NASL description The samba project reports : All versions of Samba from 4.0.0 onwards are vulnerable to infinite query recursion caused by CNAME loops. Any dns record can be added via ldap by an unprivileged user using the ldbadd tool, so this is a security issue. When configured to accept smart-card authentication, Samba last seen 2020-06-01 modified 2020-06-02 plugin id 119246 published 2018-11-28 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119246 title FreeBSD : samba -- multiple vulnerabilities (54976998-f248-11e8-81e2-005056a311d1) NASL family Fedora Local Security Checks NASL id FEDORA_2018-C2A93F8E1B.NASL description Update to Samba 4.8.7 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2019-01-03 plugin id 120763 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120763 title Fedora 28 : 2:samba (2018-c2a93f8e1b) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4345.NASL description Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2018-14629 Florian Stuelpner discovered that Samba is vulnerable to infinite query recursion caused by CNAME loops, resulting in denial of service. https://www.samba.org/samba/security/CVE-2018-14629.html - CVE-2018-16841 Alex MacCuish discovered that a user with a valid certificate or smart card can crash the Samba AD DC last seen 2020-06-01 modified 2020-06-02 plugin id 119268 published 2018-11-29 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119268 title Debian DSA-4345-1 : samba - security update NASL family Fedora Local Security Checks NASL id FEDORA_2018-E423E8743F.NASL description Update to Samba 4.9.3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2019-01-03 plugin id 120862 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120862 title Fedora 29 : 2:samba (2018-e423e8743f)
References
- https://www.samba.org/samba/security/CVE-2018-16841.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16841
- https://www.debian.org/security/2018/dsa-4345
- https://usn.ubuntu.com/3827-2/
- https://usn.ubuntu.com/3827-1/
- https://security.netapp.com/advisory/ntap-20181127-0001/
- http://www.securityfocus.com/bid/106023
- https://security.gentoo.org/glsa/202003-52