PT-2018-3374 · Samba Team+3 · Samba+2

Sam Fowler · Published 2018-08-22 · Updated 2024-06-15 · CVE-2018-16853

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Samba versions 4.7.0 through 4.9.3

Description: The issue is related to an uncontrolled system resource consumption in the Samba AD DC component when built with the non-default MIT Kerberos configuration. This can be exploited by a remote attacker to cause a denial of service, specifically crashing the Key Distribution Center (KDC) in a Samba AD domain. The Samba Team considers the MIT Kerberos build of the Samba AD DC experimental and will not issue security patches for this configuration.

Recommendations: For Samba versions 4.7.0 through 4.9.3, to prevent building of the AD DC with MIT Kerberos, it is recommended to specify --with-experimental-mit-ad-dc to the configure command when building Samba. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2018-2743

ALT-PU-2018-2744

ALT-PU-2018-2950

ALT-PU-2018-2951

BDU:2020-00696

CVE-2018-16853

ECHO-AD76-9B08-2235

OPENSUSE-SU-2024:11365-1

SUSE-SU-2018:4066-1

Affected Products

Alt Linux

Samba

Suse

References · 92

• https://samba.org/samba/security/CVE-2018-16853.html · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16853 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-52 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16853 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-16853 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4066-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16853 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00696 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2018-16853 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11365-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2019-12436 · Note
• https://suse.com/security/cve/CVE-2018-16851 · Note
• https://bugzilla.suse.com/1116320 · Note
• https://suse.com/security/cve/CVE-2018-1050 · Note