CVE-2018-16860
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.
Se encontró un fallo en la implementación de Heimdal KDC de samba, versiones 4.8.x hasta 4.8.12 excluyéndola, versiones 4.9.x hasta 4.9.8 excluyéndola, y versiones 4.10.x hasta 4.10.3 excluyéndola, cuando es usado en modo AD DC . Un atacante de tipo man in the middle podría usar este fallo para interceptar la petición al KDC y reemplazar el nombre de usuario (principal) en la petición con cualquier nombre de usuario (principal) deseado que exista en el KDC obteniendo efectivamente un ticket para este principal.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-09-11 CVE Reserved
- 2019-05-14 CVE Published
- 2024-07-24 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-358: Improperly Implemented Security Check for Standard
CAPEC
References (17)
URL | Tag | Source |
---|---|---|
http://seclists.org/fulldisclosure/2019/Aug/11 | Mailing List | |
http://seclists.org/fulldisclosure/2019/Aug/13 | Mailing List | |
http://seclists.org/fulldisclosure/2019/Aug/14 | Mailing List | |
http://seclists.org/fulldisclosure/2019/Aug/15 | Mailing List | |
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16860 | Issue Tracking | |
https://seclists.org/bugtraq/2019/Aug/21 | Mailing List | |
https://seclists.org/bugtraq/2019/Aug/22 | Mailing List | |
https://seclists.org/bugtraq/2019/Aug/23 | Mailing List | |
https://seclists.org/bugtraq/2019/Aug/25 | Mailing List | |
https://support.apple.com/HT210346 | X_refsource_confirm | |
https://support.apple.com/HT210348 | X_refsource_confirm | |
https://support.apple.com/HT210351 | X_refsource_confirm | |
https://support.apple.com/HT210353 | X_refsource_confirm | |
https://www.synology.com/security/advisory/Synology_SA_19_23 | X_refsource_confirm |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html | 2019-08-14 | |
https://security.gentoo.org/glsa/202003-52 | 2019-08-14 | |
https://www.samba.org/samba/security/CVE-2018-16860.html | 2019-08-14 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Samba Search vendor "Samba" | Samba Search vendor "Samba" for product "Samba" | >= 4.8.0 < 4.8.12 Search vendor "Samba" for product "Samba" and version " >= 4.8.0 < 4.8.12" | - |
Affected
| ||||||
Samba Search vendor "Samba" | Samba Search vendor "Samba" for product "Samba" | >= 4.9.0 < 4.9.8 Search vendor "Samba" for product "Samba" and version " >= 4.9.0 < 4.9.8" | - |
Affected
| ||||||
Samba Search vendor "Samba" | Samba Search vendor "Samba" for product "Samba" | >= 4.10.0 < 4.10.3 Search vendor "Samba" for product "Samba" and version " >= 4.10.0 < 4.10.3" | - |
Affected
| ||||||
Heimdal Project Search vendor "Heimdal Project" | Heimdal Search vendor "Heimdal Project" for product "Heimdal" | >= 0.8 <= 7.5.0 Search vendor "Heimdal Project" for product "Heimdal" and version " >= 0.8 <= 7.5.0" | - |
Affected
|