NULL pointer dereference in samba (Alpine package)

1) NULL pointer dereference

EUVDB-ID: #VU14334

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10918

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause denial of service attack.

The vulnerability exists due to a NULL pointer deference error when processing directory attributes from the LDB database layer within the DsCrackNames() function in DRSUAPI RPC server. A remote authenticated attacker can send a specially crafted request to the vulnerable samba server, trigger NULL pointer dereference error and crash the affected server.

Successful exploitation of the vulnerability requires that the Samba is configured as an Active Directory Domain Controller.

Mitigation

Install update from vendor's website.

Vulnerable software versions

samba (Alpine package): 4.7.0-r0 - 4.7.6-r0

External links

http://git.alpinelinux.org/aports/commit/?id=2a5d0006bdb59356b99ca90d9b2b6147c0d526f6
http://git.alpinelinux.org/aports/commit/?id=53e46bd2838462d43bb89139a98f91afc31b6a08
http://git.alpinelinux.org/aports/commit/?id=d773d4c9846c9af6fff4cf55c1942ce486760f82

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.