PT-2018-3374 · Samba Team+3 · Samba+2
Sam Fowler
·
Publicado
2018-08-22
·
Atualizado
2024-06-15
·
CVE-2018-16853
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Samba versions 4.7.0 through 4.9.3
Description:
The issue is related to an uncontrolled system resource consumption in the Samba AD DC component when built with the non-default MIT Kerberos configuration. This can be exploited by a remote attacker to cause a denial of service, specifically crashing the Key Distribution Center (KDC) in a Samba AD domain. The Samba Team considers the MIT Kerberos build of the Samba AD DC experimental and will not issue security patches for this configuration.
Recommendations:
For Samba versions 4.7.0 through 4.9.3, to prevent building of the AD DC with MIT Kerberos, it is recommended to specify --with-experimental-mit-ad-dc to the configure command when building Samba.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Samba
Suse