All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.25959.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Samba Samba affected
Version Status Constraints
All versions of Samba from 4.0.0 onwards affected —

Configuration 1 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:lts:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 6
samba-0:3.6.23-51.el6 cpe:/o:redhat:enterprise_linux:6 RHSA-2018:1860 2018-06-19T00:00:00Z
samba4-0:4.2.10-15.el6 cpe:/o:redhat:enterprise_linux:6 RHSA-2018:1883 2018-06-19T00:00:00Z
Red Hat Enterprise Linux 7
samba-0:4.8.3-4.el7 cpe:/o:redhat:enterprise_linux:7 RHSA-2018:3056 2018-10-30T00:00:00Z
Red Hat Gluster Storage 3.4 for RHEL 6
libtalloc-0:2.1.11-1.el6rhs cpe:/a:redhat:storage:3.4:samba:el6 RHSA-2018:2612 2018-09-04T00:00:00Z
libtdb-0:1.3.15-4.el6rhs cpe:/a:redhat:storage:3.4:samba:el6 RHSA-2018:2612 2018-09-04T00:00:00Z
libtevent-0:0.9.35-1.el6rhs cpe:/a:redhat:storage:3.4:samba:el6 RHSA-2018:2612 2018-09-04T00:00:00Z
samba-0:4.7.5-110.el6rhs cpe:/a:redhat:storage:3.4:samba:el6 RHSA-2018:2612 2018-09-04T00:00:00Z
Red Hat Gluster Storage 3.4 for RHEL 7
libtalloc-0:2.1.11-1.el7rhgs cpe:/a:redhat:storage:3.4:samba:el7 RHSA-2018:2613 2018-09-04T00:00:00Z
libtdb-0:1.3.15-4.el7rhgs cpe:/a:redhat:storage:3.4:samba:el7 RHSA-2018:2613 2018-09-04T00:00:00Z
libtevent-0:0.9.35-1.el7rhgs cpe:/a:redhat:storage:3.4:samba:el7 RHSA-2018:2613 2018-09-04T00:00:00Z
samba-0:4.7.5-110.el7rhgs cpe:/a:redhat:storage:3.4:samba:el7 RHSA-2018:2613 2018-09-04T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Canonical Subscribe
Ubuntu Linux Subscribe
Debian Subscribe
Debian Linux Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Enterprise Linux Desktop Subscribe
Enterprise Linux Server Subscribe
Enterprise Linux Workstation Subscribe
Storage Subscribe
Samba Subscribe
Samba Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-1320-1 samba security update
Debian DLA Debian DLA DLA-1754-1 samba security update
Debian DSA Debian DSA DSA-4135-1 samba security update
Ubuntu USN Ubuntu USN USN-3595-1 Samba vulnerabilities
Ubuntu USN Ubuntu USN USN-3595-2 Samba vulnerability
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://www.securityfocus.com/bid/103387 cve-icon cve-icon
http://www.securitytracker.com/id/1040493 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:1860 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:1883 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:2612 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:2613 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2018:3056 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=1538771 cve-icon cve-icon
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2018/03/msg00024.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2018-1050 cve-icon
https://security.gentoo.org/glsa/201805-07 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20180313-0001/ cve-icon cve-icon
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03834en_us cve-icon cve-icon
https://usn.ubuntu.com/3595-1/ cve-icon cve-icon
https://usn.ubuntu.com/3595-2/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2018-1050 cve-icon
https://www.debian.org/security/2018/dsa-4135 cve-icon cve-icon
https://www.samba.org/samba/security/CVE-2018-1050.html cve-icon cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-09-16T23:16:06.670Z

Reserved: 2017-12-04T00:00:00

Link: CVE-2018-1050

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-03-13T16:29:00.210

Modified: 2024-11-21T03:59:04.257

Link: CVE-2018-1050

cve-icon Redhat

Severity : Low

Publid Date: 2018-03-13T00:00:00Z

Links: CVE-2018-1050 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses