NULL pointer dereference in samba (Alpine package)
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-16851 |
| CWE-ID | CWE-476 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
samba (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) NULL pointer dereference
EUVDB-ID: #VU16156
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-16851
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to cause DoS condition.
The vulnerability exists due to the entries are cached in a single memory object with a maximum size of 256MB during the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client. A remote attacker can trigger NULL pointer dereference in the LDAP service when this size is reached and cause the process to crash.
MitigationInstall update from vendor's website.
Vulnerable software versionssamba (Alpine package): 4.1.1-r0 - 4.6.16-r1
External linkshttp://git.alpinelinux.org/aports/commit/?id=3fc4f7d95608cc32f264afea7c233f8259d802cf
http://git.alpinelinux.org/aports/commit/?id=f7ba3ea2bf6a0f6310a8526c95d88f7986735f8c
http://git.alpinelinux.org/aports/commit/?id=bd73fabb2c22b54983d0f10ae0d7c7b441b26001
http://git.alpinelinux.org/aports/commit/?id=5a2238501aacaf1b6c86507ac383022e1b09450e
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
