CVE-2018-1050 json
All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run…
published 2018-03-13 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-11704
- cvss
- 4.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.5%
- EPSS 6.5% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.
Patch / fix
- samba samba 4.5.16, 4.6.14, 4.7.6
- samba Debian 14, Debian 13, Debian 12 2:4.7.4+dfsg-2
debian advisories DEBIAN-CVE-2018-1050
- samba Ubuntu 14.04 LTS 2:4.3.11+dfsg-0ubuntu0.14.04.14
- samba Ubuntu 16.04 LTS 2:4.3.11+dfsg-0ubuntu0.16.04.13
ubuntu advisories UBUNTU-CVE-2018-1050
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- samba RHEL 7 4.8.3-4.el7
- ctdb RHEL 7 4.8.3-4.el7
- samba-dc RHEL 7 4.8.3-4.el7
- ctdb-tests RHEL 7 4.8.3-4.el7
- samba-libs RHEL 7 4.8.3-4.el7
- samba-pidl RHEL 7 4.8.3-4.el7
- samba-test RHEL 7 4.8.3-4.el7
- libwbclient RHEL 7 4.8.3-4.el7
red hat advisories RHSA-2018:3056RHSA-2018:2612RHSA-2018:2613RHSA-2018:1860RHSA-2018:1883
- samba SLES 12 SP2-BCL, SLE High Availability Extension 12 SP1, OpenStack Cloud 7 +5 more 4.2.4-28.29.1
- samba SLES 12-LTSS, SLE High Availability Extension 12 4.2.4-18.49.1
- samba SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +3 more 4.4.2-38.17.1
- samba SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 3.6.3-94.11.1
- tevent SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 0.9.34-3.3.2
- samba SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +3 more 4.6.13+git.72.2a684235f41-3.21.3
- talloc SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 2.1.10-3.3.2
suse advisories SUSE-SU-2018:2339-2SUSE-SU-2018:2339-1SUSE-SU-2018:2321-1SUSE-SU-2018:0832-1SUSE-SU-2018:0774-1SUSE-SU-2018:0754-1
- samba openSUSE Tumbleweed 4.14.6+git.182.2205d5224e3-1.1
opensuse advisories openSUSE-SU-2024:11365-1
- samba Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 4.7.6-r0
- samba Alpine 3.4 4.4.16-r2
- samba Alpine 3.5 4.5.16-r0
- samba Alpine 3.6 4.6.14-r0
alpine advisories ALPINE-CVE-2018-1050
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- samba CBL-Mariner 2.0 4.12.5-6
azure linux advisories AZL-7345
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- samba Arch Linux 4.7.6-1
arch linux advisories AVG-651
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2018-1050 updated cvss 4.3
samba: NULL pointer dereference in printer server process
-
Red Hat Enterprise Linux Client (v. 7) samba 4.8.3-4.el7, samba-libs 4.8.3-4.el7, libwbclient 4.8.3-4.el7, libsmbclient 4.8.3-4.el7, samba-client 4.8.3-4.el7, samba-common 4.8.3-4.el7, +7 more Red Hat Enterprise Linux Client Optional (v. 7) samba 4.8.3-4.el7, samba-dc 4.8.3-4.el7, samba-pidl 4.8.3-4.el7, samba-test 4.8.3-4.el7, samba-python 4.8.3-4.el7, samba-dc-libs 4.8.3-4.el7, +4 more Red Hat Enterprise Linux ComputeNode (v. 7) samba 4.8.3-4.el7, samba-libs 4.8.3-4.el7, libwbclient 4.8.3-4.el7, libsmbclient 4.8.3-4.el7, samba-client 4.8.3-4.el7, samba-common 4.8.3-4.el7, +6 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) samba 4.8.3-4.el7, samba-dc 4.8.3-4.el7, samba-pidl 4.8.3-4.el7, samba-test 4.8.3-4.el7, samba-python 4.8.3-4.el7, samba-dc-libs 4.8.3-4.el7, +5 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:3056
-
Red Hat Enterprise Linux Desktop (v. 6) samba 3.6.23-51.el6, samba4 4.2.10-15.el6, samba4-dc 4.2.10-15.el6, samba4-libs 4.2.10-15.el6, samba4-pidl 4.2.10-15.el6, samba4-test 4.2.10-15.el6, +12 more Red Hat Enterprise Linux Desktop Optional (v. 6) samba 3.6.23-51.el6, samba-swat 3.6.23-51.el6, samba-glusterfs 3.6.23-51.el6, samba-domainjoin-gui 3.6.23-51.el6, samba-winbind-krb5-locator 3.6.23-51.el6fixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:1860
-
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) samba 4.8.3-4.el7, samba-libs 4.8.3-4.el7, libwbclient 4.8.3-4.el7, libsmbclient 4.8.3-4.el7, samba-client 4.8.3-4.el7, samba-common 4.8.3-4.el7, +8 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) samba-dc 4.8.3-4.el7, samba-pidl 4.8.3-4.el7, samba-test 4.8.3-4.el7, samba-python 4.8.3-4.el7, samba-dc-libs 4.8.3-4.el7, samba-test-libs 4.8.3-4.el7, +2 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:3056
-
Red Hat Enterprise Linux HPC Node (v. 6) samba 3.6.23-51.el6, samba4 4.2.10-15.el6, samba4-dc 4.2.10-15.el6, samba4-libs 4.2.10-15.el6, samba4-pidl 4.2.10-15.el6, samba4-test 4.2.10-15.el6, +11 more Red Hat Enterprise Linux HPC Node Optional (v. 6) samba 3.6.23-51.el6, samba-swat 3.6.23-51.el6, libsmbclient 3.6.23-51.el6, samba-glusterfs 3.6.23-51.el6, samba-domainjoin-gui 3.6.23-51.el6, samba-winbind-krb5-locator 3.6.23-51.el6 Red Hat Enterprise Linux Server (v. 6) samba 3.6.23-51.el6, samba4 4.2.10-15.el6, samba4-dc 4.2.10-15.el6, samba4-libs 4.2.10-15.el6, samba4-pidl 4.2.10-15.el6, samba4-test 4.2.10-15.el6, +12 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:1860
-
Red Hat Enterprise Linux Server (v. 7) samba 4.8.3-4.el7, samba-libs 4.8.3-4.el7, libwbclient 4.8.3-4.el7, libsmbclient 4.8.3-4.el7, samba-client 4.8.3-4.el7, samba-common 4.8.3-4.el7, +8 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:3056
-
Red Hat Enterprise Linux Server Optional (v. 6) samba-swat 3.6.23-51.el6, samba-glusterfs 3.6.23-51.el6, samba-domainjoin-gui 3.6.23-51.el6, samba-winbind-krb5-locator 3.6.23-51.el6fixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:1860
-
Red Hat Enterprise Linux Server Optional (v. 7) samba-dc 4.8.3-4.el7, samba-pidl 4.8.3-4.el7, samba-test 4.8.3-4.el7, samba-python 4.8.3-4.el7, samba-dc-libs 4.8.3-4.el7, samba-test-libs 4.8.3-4.el7, +3 more Red Hat Enterprise Linux Server Resilient Storage (v. 7) ctdb 4.8.3-4.el7, ctdb-tests 4.8.3-4.el7fixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:3056
-
Red Hat Enterprise Linux Workstation (v. 6) samba 3.6.23-51.el6, samba4 4.2.10-15.el6, samba4-dc 4.2.10-15.el6, samba4-libs 4.2.10-15.el6, samba4-pidl 4.2.10-15.el6, samba4-test 4.2.10-15.el6, +12 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:1860
show 6 moreshow fewer
-
Red Hat Enterprise Linux Workstation (v. 7) samba 4.8.3-4.el7, samba-libs 4.8.3-4.el7, libwbclient 4.8.3-4.el7, libsmbclient 4.8.3-4.el7, samba-client 4.8.3-4.el7, samba-common 4.8.3-4.el7, +8 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:3056
-
Red Hat Enterprise Linux Workstation Optional (v. 6) samba-swat 3.6.23-51.el6, samba-glusterfs 3.6.23-51.el6, samba-domainjoin-gui 3.6.23-51.el6, samba-winbind-krb5-locator 3.6.23-51.el6fixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:1860
-
Red Hat Enterprise Linux Workstation Optional (v. 7) samba-dc 4.8.3-4.el7, samba-pidl 4.8.3-4.el7, samba-test 4.8.3-4.el7, samba-dc-libs 4.8.3-4.el7, samba-test-libs 4.8.3-4.el7, samba-python-test 4.8.3-4.el7, +2 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:3056
-
Red Hat Gluster 3.4 Samba on RHEL-6 ctdb 4.7.5-110.el6rhs, libtdb 1.3.15-4.el6rhs, samba 4.7.5-110.el6rhs, pytalloc 2.1.11-1.el6rhs, libtalloc 2.1.11-1.el6rhs, libtevent 0.9.35-1.el6rhs, +21 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:2612
-
Red Hat Gluster 3.4 Samba on RHEL-7 ctdb 4.7.5-110.el7rhgs, libtdb 1.3.15-4.el7rhgs, samba 4.7.5-110.el7rhgs, pytalloc 2.1.11-1.el7rhgs, libtalloc 2.1.11-1.el7rhgs, libtevent 0.9.35-1.el7rhgs, +21 morefixed: vendor fix “Ensure the paramter: rpc_server:spoolss = external is not set in the [global] section of your smb.conf.” RHSA-2018:2613
-
Red Hat Enterprise Linux 5 samba, samba3x Red Hat Enterprise Linux 8 ctdb, samba, libnetapi, ctdb-tests, samba-libs, samba-pidl, +24 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
6.51% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 2.0 | 3.3 | AV:A/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- Samba Samba
Classification
- Weakness
-
- CWE-476 NULL Pointer Dereference
References
-
usn.ubuntu.com
/3595-2/
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:2613
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:2612
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:1883
vendor-advisory, third-party-advisory
-
debian.org
/security/2018/dsa-4135
vendor-advisory, third-party-advisory
-
usn.ubuntu.com
/3595-1/
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:1860
vendor-advisory, third-party-advisory
-
access.redhat.com
/errata/RHSA-2018:3056
vendor-advisory, third-party-advisory
-
security.gentoo.org
/glsa/201805-07
vendor-advisory, third-party-advisory
-
samba.org
/samba/security/CVE-2018-1050.html
mitigation, vendor-advisory
-
securityfocus.com
/bid/103387
vdb-entry, third-party-advisory
-
securitytracker.com
/id/1040493
vdb-entry, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2018/03/msg00024.html
mailing-list, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2019/04/msg00013.html
mailing-list, third-party-advisory
-
help.ecostruxureit.com
/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
third-party-advisory
-
support.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03834en_us
third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=1538771
issue-tracking, third-party-advisory
-
security.netapp.com
/advisory/ntap-20180313-0001/
third-party-advisory
Sources
- CVE List CVE-2018-1050
- NVD CVE-2018-1050
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.