The latest stable release of the Samba 4.8 release series is available for download. It is Samba 4.8.0
Samba 4.7.6, 4.6.14 and 4.5.16 Security Releases are also available for download. These are the security releases in order to address the vulnerabilities CVE-2018-1050 (Denial of Service Attack on external print server) and CVE-2018-1057 (Authenticated users can change another users’ password)
The maintainers of the open-source software Samba have released new versions of their networking software in order to maintain two of the critical vulnerabilities which permits deprived remote attackers to launch DoS attacks against servers and alter any other user’s passwords including the admin password.
Samba is the standard Windows interoperability suite of programs for Linux and Unix. It is an open source software package that gives network administrators flexibility and freedom in terms of setup, configuration, and choice of systems and equipment. It allows operating systems such as GNU/Linux or Mac OS X, to share network shared folders, files, and printers with the Windows operating system.
All Samba versions from 4.0.0 were affected by the denial of service vulnerability which was assigned CVE-2018-1050.
“Missing input sanitization checks on some of the input parameters to spools RPC calls could cause the print spooler service to crash. If the RPC spools service is left by default as an internal service, all a client can do is crash its own authenticated connection.” Samba advisory says.
Another vulnerability which was assigned CVE-2018-1057, permits unprivileged authenticated users to alter any other users’ passwords, including admin users, over LDAP.
For all Samba versions from 4.0.0, there existed a password reset fault, but it works only in Samba Active Directory DC implementation because it doesn’t effectively validate the permissions of users when they request to modify passwords over LDAP.
Since Samba comes along with a large range of Linux distributions the risk is more for a large number of servers.
The maintainers of Samba have tackled both vulnerabilities with the release of new Samba versions 4.7.6, 4.6.14, 4.5.16 and have advised administrators to update vulnerable servers immediately.
Make sure to update your Samba versions if you are running an older version now.