PT-2018-1055 · Samba+3 · Samba+3

Björn Baumbach · Published 2018-03-13 · Updated 2024-06-15 · CVE-2018-1057

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Samba versions 4.0.0 and later

Description The issue is related to the LDAP server in Samba, specifically when configured as an Active Directory domain controller. It incorrectly validates permissions to modify passwords over LDAP, allowing authenticated users to change any other users' passwords, including those of administrative users and privileged service accounts, such as Domain Controllers. This is due to deficiencies in the authorization mechanism.

Recommendations For Samba versions 4.0.0 and later, consider restricting access to the LDAP server to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the ability of authenticated users to change passwords of other users. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2018-1411

ALT-PU-2018-1412

ALT-PU-2018-1497

ALT-PU-2018-1498

ALT-PU-2018-2488

ALT-PU-2018-2489

AZL-7346

BDU:2018-00368

CVE-2018-1057

DLA-1754-1

DSA-4135-1

ECHO-1EE2-55C5-A468

MGASA-2018-0201

OPENSUSE-SU-2018_1727-1

OPENSUSE-SU-2024:11365-1

SUSE-SU-2018:1687-1

SUSE-SU-2018_1687-1

USN-3595-1

Affected Products

Alt Linux

Samba

Suse

Ubuntu

References · 113

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/is_known_pipename.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-7494.md · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2017-7494 · Exploit
• 🔥 https://github.com/joxeankoret/CVE-2017-7494 · Exploit
• 🔥 https://github.com/betab0t/cve-2017-7494 · Exploit
• 🔥 https://github.com/d3fudd/CVE-2017-7494_SambaCry · Exploit
• 🔥 https://github.com/0xm4ud/noSAMBAnoCRY-CVE-2017-7494 · Exploit
• 🔥❌ https://github.com/elellacode/exploit-CVE-2017-7494 · Exploit, Deleted
• https://samba.org/samba/security/CVE-2018-1057.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-7346 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1050 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1057 · Vendor Advisory
• https://debian.org/security/2018/dsa-4135 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-1057 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0201.html · Security Note