NULL pointer dereference in samba (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2018-16851
CWE-ID CWE-476
Exploitation vector Network
Public exploit N/A
Vulnerable software
 samba (Alpine package)
Operating systems & Components / Operating system package or component

RoboHelp
Universal components / Libraries / Software for developers

Vendor Alpine Linux Development Team
Adobe

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) NULL pointer dereference

EUVDB-ID: #VU16156

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-16851

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition.

The vulnerability exists due to the entries are cached in a single memory object with a maximum size of 256MB during the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client. A remote attacker can trigger NULL pointer dereference in the LDAP service when this size is reached and cause the process to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

samba (Alpine package): 4.1.1-r0 - 4.6.16-r1

RoboHelp: 0.60.6-r0

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=3fc4f7d95608cc32f264afea7c233f8259d802cf
https://git.alpinelinux.org/aports/commit/?id=f7ba3ea2bf6a0f6310a8526c95d88f7986735f8c
https://git.alpinelinux.org/aports/commit/?id=bd73fabb2c22b54983d0f10ae0d7c7b441b26001
https://git.alpinelinux.org/aports/commit/?id=5a2238501aacaf1b6c86507ac383022e1b09450e


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###