CVE-2018-16841

Name
CVE-2018-16841
Description
Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Patch https://www.samba.org/samba/security/CVE-2018-16841.html
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16841
Third Party Advisory https://www.debian.org/security/2018/dsa-4345
Third Party Advisory https://usn.ubuntu.com/3827-2/
Third Party Advisory https://usn.ubuntu.com/3827-1/
Third Party Advisory https://security.netapp.com/advisory/ntap-20181127-0001/
VDB Entry http://www.securityfocus.com/bid/106023
GENTOO https://security.gentoo.org/glsa/202003-52

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.8.8 < 4.9.3
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.8.0 < 4.8.7
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.3.0 < 4.7.12

Vulnerable and fixed packages

Source package Branch Version Maintainer Status