Vulnetix
Try Vulnetix Request Demo
ALPINE-CVE-2018-16841 PUBLISHED CVSS 6.5 MEDIUM

Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.

Risk Scores

CVSS v3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

VendorProductVersions
Alpine:v3.21samba4.8.5-r0, 0, 3.2.10-r0
Alpine:v3.10samba4.8.4-r1, 0, 3.2.10-r0
Alpine:v3.22samba4.8.5-r0, 0, 3.2.10-r0
Alpine:v3.19samba4.6.6-r0, 0, 3.2.10-r0
Alpine:v3.16samba4.8.5-r0, 0, 3.2.11-r0
Alpine:v3.15samba3.2.10-r0, 3.2.11-r1, 3.2.8-r0
Alpine:v3.12samba4.1.6-r0, 3.2.10-r0, 3.2.11-r0
Alpine:v3.18samba4.1.10-r0, 0, 4.8.5-r0
Alpine:v3.9samba3.2.11-r0, 3.2.11-r1, 3.2.8-r0
Alpine:v3.11samba3.6.8-r0, 0, 3.2.10-r0
Alpine:v3.20samba4.2.3-r1, 4.2.3-r2, 4.2.3-r3
Alpine:v3.23samba4.2.9-r1, 4.8.5-r0, 4.8.4-r1
Alpine:v3.14samba4.7.0-r1, 3.6.12-r0, 3.6.13-r0
Alpine:v3.6samba4.2.1-r0, 4.6.8-r0, 4.6.4-r1
Alpine:v3.17samba3.4.5-r1, 4.8.5-r0, 4.8.4-r1
Alpine:v3.13samba4.2.3-r0, 4.2.3-r1, 4.2.3-r2
Alpine:v3.8samba4.1.7-r0, 4.8.4-r0, 4.8.2-r1
Alpine:v3.7samba4.7.6-r1, 4.7.6-r0, 4.7.4-r0

Timeline

References

Open in Interactive Console →