Name: CVE-2018-1139: Improper Input Validation
Creator: Rapid7
Published: 2018-08-22T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2018-1139, CWE-20, CWE-522, CVSS 8.1, EPSS 0.01526

A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.

CVSS Details

CVSS 3.1 Base Score: 8.1
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS 3.0 Base Score: 5.4
CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade samba	Aug 24, 2018	Aug 22, 2018
Amazon Linux Ami 2	—	Upgrade ctdbUpgrade samba-winbind-krb5-locatorUpgrade samba-pythonUpgrade samba-winbind-clientsUpgrade samba-winbind-modulesUpgrade samba-commonUpgrade samba-test-libsUpgrade samba-python-testUpgrade samba-common-toolsUpgrade samba-common-libsUpgrade samba-dc-libsUpgrade libwbclient-develUpgrade samba-winbindUpgrade sambaUpgrade samba-vfs-glusterfsUpgrade libsmbclientUpgrade samba-clientUpgrade samba-pidlUpgrade samba-testUpgrade samba-libsUpgrade ctdb-testsUpgrade samba-krb5-printingUpgrade samba-debuginfoUpgrade libwbclientUpgrade samba-client-libsUpgrade libsmbclient-develUpgrade samba-develUpgrade samba-dc	Apr 27, 2020	Aug 22, 2018
Amazon_linux	—	Upgrade samba	Jan 25, 2019	Aug 14, 2018
Centos_linux	—	Upgrade samba-debuginfoUpgrade samba-testUpgrade samba-winbindUpgrade samba-develUpgrade samba-dcUpgrade samba-commonUpgrade samba-python-testUpgrade samba-pythonUpgrade sambaUpgrade samba-pidlUpgrade samba-vfs-glusterfsUpgrade samba-libsUpgrade samba-client-libsUpgrade samba-test-libsUpgrade libsmbclientUpgrade libwbclientUpgrade samba-krb5-printingUpgrade samba-winbind-modulesUpgrade samba-common-toolsUpgrade libsmbclient-develUpgrade samba-common-libsUpgrade samba-clientUpgrade samba-winbind-clientsUpgrade samba-winbind-krb5-locatorUpgrade libwbclient-develUpgrade samba-dc-libs	Aug 28, 2019	Aug 22, 2018
Debian	—	Upgrade samba	Jul 30, 2024	Aug 22, 2018
Freebsd	—	Upgrade samba48Upgrade samba46Upgrade samba47	Aug 15, 2018	Aug 14, 2018
Gentoo Linux	—	Upgrade net-fs/samba.	Mar 27, 2020	Aug 22, 2018
Huawei Euleros 2_0_sp5	—	Upgrade samba-commonUpgrade samba-libsUpgrade samba-client-libsUpgrade libwbclientUpgrade samba-pythonUpgrade samba-common-libsUpgrade samba-winbindUpgrade samba-clientUpgrade samba-winbind-modulesUpgrade sambaUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-common-tools	May 30, 2019	Aug 22, 2018
Oracle Solaris	—	Upgrade library/samba/libsmbclient to version 4.8.4-11.4.1.0.1.2.0 on Solaris 11.4Upgrade service/network/samba to version 4.8.4-11.4.1.0.1.2.0 on Solaris 11.4	Oct 19, 2018	Aug 22, 2018
Oracle_linux	—	Upgrade ctdbUpgrade sambaUpgrade samba-pythonUpgrade samba-winbindUpgrade samba-vfs-glusterfsUpgrade samba-pidlUpgrade samba-commonUpgrade samba-dcUpgrade samba-develUpgrade samba-python-testUpgrade samba-testUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-common-toolsUpgrade samba-libsUpgrade ctdb-testsUpgrade libwbclient-develUpgrade samba-winbind-krb5-locatorUpgrade libsmbclient-develUpgrade samba-clientUpgrade samba-client-libsUpgrade samba-winbind-modulesUpgrade samba-common-libsUpgrade samba-krb5-printingUpgrade samba-dc-libsUpgrade libwbclientUpgrade samba-test-libs	Nov 6, 2018	Aug 16, 2018
Redhat_linux	—	Upgrade samba-test-libsUpgrade samba-libsUpgrade libsmbclient-develUpgrade samba-pidlUpgrade libwbclientUpgrade samba-krb5-printingUpgrade samba-commonUpgrade samba-develUpgrade samba-testUpgrade samba-client-libsUpgrade samba-common-libsUpgrade libwbclient-develUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade sambaUpgrade samba-vfs-glusterfsUpgrade samba-debuginfoUpgrade samba-python-testUpgrade samba-winbind-modulesUpgrade samba-pythonUpgrade samba-dc-libsUpgrade samba-dcUpgrade samba-common-toolsUpgrade samba-winbind-krb5-locatorUpgrade samba-winbind	Oct 31, 2018	Aug 22, 2018
Samba	—	Upgrade to Samba version 4.8.4Upgrade to Samba version 4.7.9	Aug 15, 2018	Aug 15, 2018
Suse	—	Upgrade samba-libs-python3Upgrade samba-cephUpgrade libsamba-passdb-develUpgrade libwbclient0Upgrade libwbclient-develUpgrade libdcerpc-samr0-32bitUpgrade samba-libsUpgrade ctdb-testsUpgrade samba-libs-python3-32bitUpgrade libsamba-hostconfig-develUpgrade samba-python3Upgrade libsmbconf0Upgrade libsamba-policy0-python3Upgrade libsamba-util-develUpgrade libsamba-policy0Upgrade samba-testUpgrade samba-pidlUpgrade libndr-krb5pac-develUpgrade samba-pythonUpgrade libsmbclient-develUpgrade libdcerpc-binding0Upgrade libndr-standard0-32bitUpgrade libndr-krb5pac0Upgrade sambaUpgrade libsmbldap2-32bitUpgrade libsamba-credentials0Upgrade libdcerpc-samr0Upgrade samba-winbindUpgrade libsmbconf0-32bitUpgrade libnetapi0Upgrade samba-dsdb-modulesUpgrade libdcerpc-develUpgrade libsamba-passdb0-32bitUpgrade libsmbldap-develUpgrade libwbclient0-32bitUpgrade samba-core-develUpgrade libtevent-util0-32bitUpgrade libsamdb-develUpgrade libsmbclient0Upgrade libsamba-errors-develUpgrade ctdbUpgrade libsamba-errors0Upgrade libsmbconf-develUpgrade libtevent-util-develUpgrade samba-libs-32bitUpgrade libndr0-32bitUpgrade libsamba-credentials0-32bitUpgrade libsamba-passdb0Upgrade samba-client-32bitUpgrade libndr1-32bitUpgrade libdcerpc-samr-develUpgrade libsamba-policy-develUpgrade libndr0Upgrade libtevent-util0Upgrade libndr-develUpgrade libsamba-hostconfig0Upgrade libdcerpc-binding0-32bitUpgrade libsamba-credentials-develUpgrade libsmbclient0-32bitUpgrade libsamba-hostconfig0-32bitUpgrade libnetapi-develUpgrade libsamba-policy0-32bitUpgrade samba-docUpgrade libdcerpc0Upgrade libnetapi0-32bitUpgrade samba-clientUpgrade samba-kdcUpgrade samba-winbind-32bitUpgrade libdcerpc0-32bitUpgrade libsamdb0-32bitUpgrade libndr-nbt0Upgrade libndr1Upgrade libsamdb0Upgrade libndr-standard-develUpgrade libndr-standard0Upgrade libsamba-util0Upgrade ctdb-pcp-pmdaUpgrade libsamba-policy-python3-develUpgrade libndr-nbt0-32bitUpgrade samba-kdc-32bitUpgrade libndr-krb5pac0-32bitUpgrade libndr-nbt-develUpgrade libsamba-util0-32bitUpgrade libsmbldap2Upgrade libsamba-errors0-32bit	Aug 18, 2018	Aug 14, 2018
Ubuntu	—	Upgrade sambaUpgrade libsmbclient	Aug 17, 2018	Aug 14, 2018

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business