CVE-2018-16841

Source
Severity High
Remote Yes
Type Denial of service
Description
A double-free issue has been found in samba from 4.3.0 up to and including 4.9.2, where a user with a valid certificate or smart card can crash the Samba AD DC's KDC.
When configured to accept smart-card authentication, Samba's KDC willcall talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process. There is no further vulnerability associated with this issue, merely a denial of service.
Group Package Affected Fixed Severity Status Ticket
AVG-823 samba 4.9.2-1 4.9.3-1 High Fixed
Date Advisory Group Package Severity Description
28 Nov 2018 ASA-201811-22 AVG-823 samba High multiple issues
References
https://www.samba.org/samba/security/CVE-2018-16841.html
https://bugzilla.samba.org/show_bug.cgi?id=13628
https://github.com/samba-team/samba/commit/6e84215d4aa7ef51096db3b187adbe22cacdd921