CVE-2018-10858
MEDIUM severity · CVSS 4.3 · Improper input validation
4.3CVSS MEDIUM
Summary
A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredHigh
User interactionRequired
Confidentiality impactLow
Integrity impactLow
Availability impactLow
Exploit probability (EPSS)4%
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://www.securityfocus.com/bid/105085Advisory
- http://www.securitytracker.com/id/1042002Advisory
- https://access.redhat.com/errata/RHSA-2018:2612Advisory
- https://access.redhat.com/errata/RHSA-2018:2613Advisory
- https://access.redhat.com/errata/RHSA-2018:3056Advisory
- https://access.redhat.com/errata/RHSA-2018:3470Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10858Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10284