CVE-2018-16853

Severity Score

5.9

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command.

Samba, desde la versión 4.7.0, tiene una vulnerabilidad que permite que un usuario en el dominio Samba AD provoque el cierre inesperado del KDC cuando Samba se incluye en la configuración de MIT Kerberos que no es la predeterminada. Con este advisory, el equipo de Samba aclara que la build MIT Kerberos de Samba AC DC se considera experimental. Por lo tanto, el equipo de Samba no publicará parches de seguridad para esta configuración. Además, Samba 4.7.12, 4.8.7 y 4.9.3 se han publicado como versiones de seguridad para evitar que se incluya AD DC con MIT Kerberos, a menos que --with-experimental-mit-ad-dc se especifique en el comando configure.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-09-11 CVE Reserved
2018-11-28 CVE Published
2024-05-30 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (5)

URL	Tag	Source
http://www.securityfocus.com/bid/106026	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16853	Issue Tracking
https://security.netapp.com/advisory/ntap-20181127-0001	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://security.gentoo.org/glsa/202003-52	2019-10-09
https://www.samba.org/samba/security/CVE-2018-16853.html	2019-10-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				>= 4.7.0 < 4.7.12 Search vendor "Samba" for product "Samba" and version " >= 4.7.0 < 4.7.12"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				>= 4.8.0 < 4.8.7 Search vendor "Samba" for product "Samba" and version " >= 4.8.0 < 4.8.7"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				>= 4.9.0 < 4.9.3 Search vendor "Samba" for product "Samba" and version " >= 4.9.0 < 4.9.3"		-		Affected