CVE-2018-1139

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.

Database specific

{
    "unresolved_ranges": [
        {
            "cpe": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "14.04"
                }
            ]
        },
        {
            "cpe": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "16.04"
                }
            ]
        },
        {
            "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "18.04"
                }
            ]
        },
        {
            "cpe": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "7.0"
                }
            ]
        },
        {
            "cpe": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "7.0"
                }
            ]
        },
        {
            "cpe": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "7.0"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/samba-team/samba

Affected ranges

Type

GIT

Repo

https://github.com/samba-team/samba

Events

Introduced

d1e69845e28c20a491c4cd60c712b46ddfcb9dc0

Fixed

3e5da7e8878a78da96fbdccd05953c791560a6b5

Introduced

5a9d09fee44052e18ce241ec28f78498d2e20d73

Fixed

626c489c2c879aef8b82efe9f7e832cca0183f4d

Database specific

{
    "cpe": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*",
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "4.7.0"
        },
        {
            "fixed": "4.7.9"
        },
        {
            "introduced": "4.8.0"
        },
        {
            "fixed": "4.8.4"
        }
    ]
}

Affected versions

ldb-1.*

ldb-1.2.3

ldb-1.3.3

ldb-1.3.4

ldb-1.3.5

samba-4.*

samba-4.7.0

samba-4.7.1

samba-4.7.2

samba-4.7.4

samba-4.7.5

samba-4.7.7

samba-4.7.8

samba-4.8.0

samba-4.8.1

samba-4.8.2

samba-4.8.3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1139.json"