Pierluigi Paganini March 13, 2018

Maintainers at the Samba project have released new versions of the popular networking software to fix two critical vulnerabilities.

Maintainers at the Samba project have released new versions of the popular open-source networking software to address two critical vulnerabilities that could be exploited by unprivileged remote attackers to launch DoS attacks against servers and change any users’ passwords, including administrators ‘ones.

Samba has provided secure and fast file and print services for all clients using the SMB/CIFS protocol, it allows non-Windows operating systems, like GNU/Linux or Mac OS X, to share network shared folders, files, and printers with Windows OS.

The maintainers of Samba have addressed the vulnerabilities with the release of the Samba versions 4.7.6, 4.6.14, 4.5.16.

The first DoS vulnerability tracked as CVE-2018-1050 could be exploited “when the RPC spoolss service is configured to be run as an external daemon.”

The vulnerability is caused by the lack of input sanitizations checks on some parameters and affects all versions of Samba from 4.0.0 onwards.

“Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash. If the RPC spoolss service is left by default as an internal service, all a client can do is crash its own authenticated connection.” reads the security advisory.

A second flaw, tracked CVE-2018-1057, could be exploited by unprivileged authenticated users to change any other users’ passwords, including admin users, over LDAP. Samba doesn’t properly validate permissions of users when they request to modify passwords over LDAP.

The flaw only impacts on the Samba Active Directory DC, all versions of Samba’s AD DC and pre-release versions since Samba 4.0.0alpha13 are affected by this vulnerability.

Administrators need to update vulnerable servers immediately; further details have been published on the “Samba Security Releases” page.