CVE-2018-16851
CVSS V2 Medium 4
CVSS V3 Medium 6.5
Description
Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service.
Overview
- CVE ID
- CVE-2018-16851
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Analyzed
- Published Version
- 2018-11-28T14:29:00
- Last Modified Date
- 2022-08-29T20:03:55
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* | 1 | OR | 4.0.0 | 4.7.12 |
| cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* | 1 | OR | 4.8.0 | 4.8.7 |
| cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* | 1 | OR | 4.9.0 | 4.9.3 |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:S/C:N/I:N/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- SINGLE
- Confidentiality Impact
- NONE
- Integrity Impact
- NONE
- Availability Impact
- PARTIAL
- Base Score
- 4
- Severity
- MEDIUM
- Exploitability Score
- 8
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- NONE
- Availability Impact
- HIGH
- Base Score
- 6.5
- Base Severity
- MEDIUM
- Exploitability Score
- 2.8
- Impact Score
- 3.6
References
| Reference URL | Reference Tags |
|---|---|
| https://www.samba.org/samba/security/CVE-2018-16851.html | Patch Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16851 | Issue Tracking Third Party Advisory |
| https://www.debian.org/security/2018/dsa-4345 | Third Party Advisory |
| https://usn.ubuntu.com/3827-2/ | Third Party Advisory |
| https://usn.ubuntu.com/3827-1/ | Third Party Advisory |
| https://security.netapp.com/advisory/ntap-20181127-0001/ | Third Party Advisory |
| http://www.securityfocus.com/bid/106027 | Third Party Advisory VDB Entry |
| https://lists.debian.org/debian-lts-announce/2018/12/msg00005.html | Mailing List Third Party Advisory |
| https://security.gentoo.org/glsa/202003-52 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2018-16851 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16851 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 17:06:01 | Added to TrackCVE | |||
| 2022-12-03 14:47:27 | 2018-11-28T14:29Z | 2018-11-28T14:29:00 | CVE Published Date | updated |
| 2022-12-03 14:47:27 | 2022-08-29T20:03:55 | CVE Modified Date | updated | |
| 2022-12-03 14:47:27 | Analyzed | Vulnerability Status | updated |