Samba releases the security update to address two flaws

On March 13, 2018, Samba team releases the security patch to address two flaws in Samba. An attacker could exploit one of these vulnerabilities to take control of an affected system.

The detail is below:

• CVE-2018-1050
  All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.

  There is no known vulnerability associated with this error, merely a denial of service. If the RPC spoolss service is left by default as an internal service, all a client can do is crash its own authenticated connection.

  Affected version

  All versions of Samba from 4.0.0 onwards

  Solusion
  
  Install patch for Samba 4.7.6, 4.6.14 and 4.5.16

• CVE-2018-1057
  On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users’ passwords, including administrative users and privileged service accounts (eg Domain Controllers).

  The LDAP server incorrectly validates certain LDAP password modifications against the “Change Password” privilege, but then performs a password reset operation.

  The change password right in AD is an extended object access right with the GUID ab721a53-1e2f-11d0-9819-00aa0040529b.

  By default user objects grant the change password right to the authenticated user’s own user object (self) and to everyone (world). Computer objects grant the change password right to everyone.
  
  Affected version

  Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards

  Solusion
  
  Install patch for Samba 4.7.6, 4.6.14 and 4.5.16

Source: samba