Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1139: A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client. 1589651: CVE-2018-1139 samba: Weak authentication protocol regression CVE-2018-10858: A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. 1612805: CVE-2018-10858 samba: Insufficient input validation in libsmbclient CVE-2018-1050: A null pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash. 1538771: CVE-2018-1050 samba: NULL pointer dereference in printer server process
Fixed packages 28
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ctdb | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | ctdb-tests | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | libsmbclient | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | libsmbclient-devel | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | libwbclient | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | libwbclient-devel | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-client | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-client-libs | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-common | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-common-libs | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-common-tools | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-dc | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-dc-libs | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-debuginfo | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-devel | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-krb5-printing | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-libs | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-pidl | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-python | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-python-test | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-test | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-test-libs | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-vfs-glusterfs | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-winbind | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-winbind-clients | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-winbind-krb5-locator | 0:4.8.3-4.amzn2.0.1 |
| Amazon Linux · 2 | samba-winbind-modules | 0:4.8.3-4.amzn2.0.1 |
Vulnerabilities 3
-
Medium 5.4
A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1…
-
Medium 4.3
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malic…
-
Unscored —
All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is c…