CVE-2018-10918

MEDIUM

Samba 4.7.0-4.7.8 - Authenticated Denial of Service via LDB Database Layer

Title source: llm

Description

A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An authenticated attacker could use this flaw to crash a samba server in an Active Directory Domain Controller configuration. Samba versions before 4.7.9 and 4.8.4 are vulnerable.

References (6)

Core 6

Core References

Patch, Vendor Advisory x_refsource_confirm

https://www.samba.org/samba/security/CVE-2018-10918.html

Issue Tracking, Third Party Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10918

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/3738-1/

Third Party Advisory x_refsource_confirm

https://security.netapp.com/advisory/ntap-20180814-0001/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105083

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/202003-52

Scores

CVSS v3 5.2

EPSS 0.0426

EPSS Percentile 88.9%

Attack Vector ADJACENT_NETWORK

CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Details

CWE

CWE-476

Status published

Products (4)

canonical/ubuntu_linux 14.04

canonical/ubuntu_linux 16.04

canonical/ubuntu_linux 18.04

samba/samba 4.7.0 - 4.7.9

Published Aug 22, 2018

Tracked Since Feb 18, 2026