Skip to content
OpenAdvisories
Medium ALAS2-2018-1126 3 CVEs

Moderate: samba security update (Amazon Linux 2)

Published Dec 13, 2018 · Updated Dec 19, 2018

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-1139: A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client. 1589651: CVE-2018-1139 samba: Weak authentication protocol regression CVE-2018-10858: A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. 1612805: CVE-2018-10858 samba: Insufficient input validation in libsmbclient CVE-2018-1050: A null pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash. 1538771: CVE-2018-1050 samba: NULL pointer dereference in printer server process

Fixed packages 28

ReleasePackageFixed in
Amazon Linux · 2 ctdb 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 ctdb-tests 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 libsmbclient 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 libsmbclient-devel 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 libwbclient 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 libwbclient-devel 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-client 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-client-libs 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-common 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-common-libs 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-common-tools 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-dc 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-dc-libs 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-debuginfo 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-devel 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-krb5-printing 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-libs 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-pidl 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-python 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-python-test 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-test 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-test-libs 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-vfs-glusterfs 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-winbind 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-winbind-clients 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-winbind-krb5-locator 0:4.8.3-4.amzn2.0.1
Amazon Linux · 2 samba-winbind-modules 0:4.8.3-4.amzn2.0.1

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-1050.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-10858.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-1139.html