PT-2019-2114 · Samba+4 · Samba+4

Andrew Bartlett + 1 · Published 2019-05-14 · Updated 2024-06-15 · CVE-2018-16860

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samba versions 4.8.x up to, excluding 4.8.12 Samba versions 4.9.x up to, excluding 4.9.8 Samba versions 4.10.x up to, excluding 4.10.3

Description A flaw was found in Samba's Heimdal KDC implementation when used in AD DC mode, allowing a man-in-the-middle attacker to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC, effectively obtaining a ticket for that principal. The issue is related to improper checksum validation in the S4U2Self extension, which can allow attackers to elevate their privileges and access privileged resources.

Recommendations For Samba versions 4.8.x up to, excluding 4.8.12, update to version 4.8.12 or later to resolve the issue. For Samba versions 4.9.x up to, excluding 4.9.8, update to version 4.9.8 or later to resolve the issue. For Samba versions 4.10.x up to, excluding 4.10.3, update to version 4.10.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the Heimdal KDC implementation to minimize the risk of exploitation.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

ALT-PU-2019-2020

ALT-PU-2019-2079

BDU:2019-01870

CVE-2018-16860

DLA-1788-1

DSA-4443-1

DSA-4455-1

ECHO-9CF7-2C5D-DCF9

OPENSUSE-SU-2019:1682-1

OPENSUSE-SU-2019:1688-1

OPENSUSE-SU-2019:1888-1

OPENSUSE-SU-2019_1682-1

OPENSUSE-SU-2024:10946-1

OPENSUSE-SU-2024:11365-1

USN-3976-1

USN-3976-2

USN-3976-3

USN-3976-4

USN-5675-1

Affected Products

Alt Linux

Linuxmint

Samba

Suse

Ubuntu

References · 125

• https://osv.dev/vulnerability/USN-5675-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01870 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-16860 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:1888-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3976-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-52 · Vendor Advisory
• https://samba.org/samba/security/CVE-2018-16860.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3976-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3976-3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16860 · Security Note
• https://osv.dev/vulnerability/USN-3976-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16860 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-16860 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1688-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3116 · Vendor Advisory