Improper access control in Samba - CVE-2018-14628

Vulnerability identifier: #VU83535

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-14628

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to improper access restrictions when Samba is an Active Directory Domain Controller. When a domain was provisioned with an unpatched Samba version, the ntSecurityDescriptor is simply inherited from Domain/Partition-HEAD-Object instead of being very strict (as on a Windows provisioned domain). This means also non privileged users can use the LDAP_SERVER_SHOW_DELETED_OID control in order to view, the names and preserved attributes of deleted objects.

Samba
Gentoo Linux
Amazon Linux AMI
Slackware Linux
Anolis OS
Fedora
samba
net-fs/samba
samba-vfs-iouring
samba-dcerpc
samba-devel
samba-gpupdate
samba-krb5-printing
samba-ldb-ldap-modules
samba-libs
samba-test
samba-test-libs
samba-tools
samba-usershares
samba-vfs-glusterfs
samba-dc
samba-winbind
samba-winbind-clients
samba-winbind-krb5-locator
samba-winbind-modules
samba-common
samba-dc-provision
samba-pidl
samba-dc-bind-dlz
ctdb
libnetapi
libnetapi-devel
libsmbclient
libsmbclient-devel
libwbclient
libwbclient-devel
python3-samba
python3-samba-dc
python3-samba-devel
python3-samba-test
samba-client
samba-client-libs
samba-common-libs
samba-common-tools
samba-dc-libs

Install updates from vendor's website.

Samba - update to 4.19.3
samba - update to 4.17.8-0
samba - update to 4.18.9
net-fs/samba - update to 4.18.9
samba-vfs-iouring - update to 4.18.9-1
samba-dcerpc - update to 4.18.9-1
samba-devel - update to 4.18.9-1
samba-gpupdate - update to 4.18.9-1
samba-krb5-printing - update to 4.18.9-1
samba-ldb-ldap-modules - update to 4.18.9-1
samba-libs - update to 4.18.9-1
samba-test - update to 4.18.9-1
samba-test-libs - update to 4.18.9-1
samba-tools - update to 4.18.9-1
samba-usershares - update to 4.18.9-1
samba-vfs-glusterfs - update to 4.18.9-1
samba-dc - update to 4.18.9-1
samba-winbind - update to 4.18.9-1
samba-winbind-clients - update to 4.18.9-1
samba-winbind-krb5-locator - update to 4.18.9-1
samba-winbind-modules - update to 4.18.9-1
samba-common - update to 4.18.9-1
samba-dc-provision - update to 4.18.9-1
samba-pidl - update to 4.18.9-1
samba-dc-bind-dlz - update to 4.18.9-1
ctdb - update to 4.18.9-1
libnetapi - update to 4.18.9-1
libnetapi-devel - update to 4.18.9-1
libsmbclient - update to 4.18.9-1
libsmbclient-devel - update to 4.18.9-1
libwbclient - update to 4.18.9-1
libwbclient-devel - update to 4.18.9-1
python3-samba - update to 4.18.9-1
python3-samba-dc - update to 4.18.9-1
python3-samba-devel - update to 4.18.9-1
python3-samba-test - update to 4.18.9-1
samba - update to 4.18.9-1
samba-client - update to 4.18.9-1
samba-client-libs - update to 4.18.9-1
samba-common-libs - update to 4.18.9-1
samba-common-tools - update to 4.18.9-1
samba-dc-libs - update to 4.18.9-1
samba - addressed in versions 4.18.9-1.fc38, 4.19.3-1.fc39

• https://bugzilla.samba.org/show_bug.cgi?id=13595
• https://bugzilla.redhat.com/show_bug.cgi?id=1625445
• https://www.samba.org/samba/security/CVE-2018-14628.html
• https://www.samba.org/samba/history/samba-4.19.3.html

• Information disclosure in Samba
• Fedora 39 update for samba
• Fedora 38 update for samba
• Slackware Linux update for samba
• Gentoo update for Samba
• Amazon Linux AMI update for samba
• Amazon Linux AMI update for samba
• Anolis OS update for samba