CVE-2018-1050

All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.

CVSS v3.0 4.3 MEDIUM
CVSS v2.0 3.3 LOW

4.3^/10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:A/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://www.samba.org/samba/security/CVE-2018-1050.html	Mitigation Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1538771	Issue Tracking Third Party Advisory
https://www.debian.org/security/2018/dsa-4135	Third Party Advisory
https://security.netapp.com/advisory/ntap-20180313-0001/	Third Party Advisory
http://www.securitytracker.com/id/1040493	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/103387	Third Party Advisory VDB Entry
https://usn.ubuntu.com/3595-1/	Third Party Advisory
https://usn.ubuntu.com/3595-2/	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/03/msg00024.html	Mailing List Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03834en_us	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1883	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1860	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2613	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2612	Third Party Advisory
https://security.gentoo.org/glsa/201805-07	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3056	Third Party Advisory
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:12.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:17.10::::lts:::

Configuration 2 (hide)

OR	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::

Configuration 3 (hide)

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:7.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration 4 (hide)

OR	cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*

Information

Published : 2018-03-13 09:29

Updated : 2022-09-01 09:35

NVD link : CVE-2018-1050

Mitre link : CVE-2018-1050

JSON object : View

CWE

CWE-476

NULL Pointer Dereference

Products Affected

redhat

enterprise_linux_desktop
enterprise_linux_workstation
enterprise_linux_server

canonical

ubuntu_linux

samba

samba

debian

debian_linux

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.samba.org/samba/security/CVE-2018-1050.html", "name": "https://www.samba.org/samba/security/CVE-2018-1050.html", "tags": ["Mitigation", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1538771", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1538771", "tags": ["Issue Tracking", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://www.debian.org/security/2018/dsa-4135", "name": "DSA-4135", "tags": ["Third Party Advisory"], "refsource": "DEBIAN"}, {"url": "https://security.netapp.com/advisory/ntap-20180313-0001/", "name": "https://security.netapp.com/advisory/ntap-20180313-0001/", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.securitytracker.com/id/1040493", "name": "1040493", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/103387", "name": "103387", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "https://usn.ubuntu.com/3595-1/", "name": "USN-3595-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "https://usn.ubuntu.com/3595-2/", "name": "USN-3595-2", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00024.html", "name": "[debian-lts-announce] 20180327 [SECURITY] [DLA 1320-1] samba security update", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03834en_us", "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03834en_us", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://access.redhat.com/errata/RHSA-2018:1883", "name": "RHSA-2018:1883", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:1860", "name": "RHSA-2018:1860", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2613", "name": "RHSA-2018:2613", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://access.redhat.com/errata/RHSA-2018:2612", "name": "RHSA-2018:2612", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://security.gentoo.org/glsa/201805-07", "name": "GLSA-201805-07", "tags": ["Third Party Advisory"], "refsource": "GENTOO"}, {"url": "https://access.redhat.com/errata/RHSA-2018:3056", "name": "RHSA-2018:3056", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0", "name": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html", "name": "[debian-lts-announce] 20190409 [SECURITY] [DLA 1754-1] samba security update", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-476"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-1050", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "LOW", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}}, "publishedDate": "2018-03-13T16:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.7.6", "versionStartIncluding": "4.7.0"}, {"cpe23Uri": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.6.14", "versionStartIncluding": "4.6.0"}, {"cpe23Uri": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.5.16", "versionStartIncluding": "3.6.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-09-01T16:35Z"}

4.3 /10

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

3.3 /10

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

JSON object

Attach tags to CVE-2018-1050

4.3^/10

3.3^/10

Attach tags to `CVE-2018-1050`