Bug 1646377 (CVE-2018-16851)

Summary:	CVE-2018-16851 samba: NULL pointer de-reference in Samba AD DC LDAP server
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, abokovoy, anoopcs, asn, bmcclain, dbaker, dblechte, dfediuck, eedri, gdeschner, jarrpa, jokerman, jstephen, lmohanty, madam, mgoldboi, michal.skrivanek, rhs-smb, sankarshan, sbonazzo, sbose, security-response-team, sherold, sisharma, smohan, ssaha, ssorce, sthangav, trankin, vbellur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	samba 4.7.12, samba 4.8.7, samba 4.9.3	Doc Type:	If docs needed, set a value
Doc Text:	A null pointer dereference was found in the way LDAP search was implemented when Samba is used as Active Directory Domain Controller. A remote, authenticated attacker could use this flaw to cause a denial of service (application crash).	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-11-28 07:27:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1654091
Bug Blocks:	1646387

Description Laura Pardo 2018-11-05 13:36:25 UTC

A flaw was found in Samba versions from 4.0.0. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB.  When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. This can lead to a denial of service attack.

Comment 2 Sam Fowler 2018-11-28 02:54:49 UTC

External Reference:

https://www.samba.org/samba/security/CVE-2018-16851.html

Comment 3 Sam Fowler 2018-11-28 02:55:00 UTC

Acknowledgments:

Name: Garming Sam (Samba Team and Catalyst)

Comment 4 Sam Fowler 2018-11-28 02:55:35 UTC

Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1654091]

Comment 5 Huzaifa S. Sidhpurwala 2018-11-28 07:27:31 UTC

Statement:

This flaw does not affect the version of samba shipped with Red Hat Enterprise Linux because there is no support for samba as Active Directory Domain Controller.