8.1

CVE-2018-1139

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Samba ≫ Samba Version >= 4.7.0 < 4.7.9
Samba ≫ Samba Version >= 4.8.0 < 4.8.4
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.11% 0.861
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
secalert@redhat.com 5.4 2.8 2.5
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://access.redhat.com/errata/RHSA-2018:2612
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2613
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3056
Third Party Advisory
http://www.securityfocus.com/bid/105084
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1139
Third Party Advisory
Issue Tracking
https://security.gentoo.org/glsa/202003-52
Third Party Advisory
https://security.netapp.com/advisory/ntap-20180814-0001/
Third Party Advisory
https://usn.ubuntu.com/3738-1/
Third Party Advisory
https://www.samba.org/samba/security/CVE-2018-1139.html
Third Party Advisory