CVE-2018-16860

A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
redhatCNA
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
VendorProductVersion
sambasamba
4.8.0 ≤
𝑥
< 4.8.12
sambasamba
4.9.0 ≤
𝑥
< 4.9.8
sambasamba
4.10.0 ≤
𝑥
< 4.10.3
heimdal_projectheimdal
0.8 ≤
𝑥
≤ 7.5.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
heimdal
bullseye (security)
7.7.0+dfsg-2+deb11u3
fixed
bullseye
7.7.0+dfsg-2+deb11u3
fixed
jessie
no-dsa
bookworm
7.8.git20221117.28daf24+dfsg-2
fixed
sid
7.8.git20221117.28daf24+dfsg-8
fixed
trixie
7.8.git20221117.28daf24+dfsg-8
fixed
samba
bullseye (security)
2:4.13.13+dfsg-1~deb11u6
fixed
bullseye
2:4.13.13+dfsg-1~deb11u6
fixed
jessie
no-dsa
bookworm
2:4.17.12+dfsg-0+deb12u1
fixed
bookworm (security)
2:4.17.12+dfsg-0+deb12u1
fixed
sid
2:4.21.1+dfsg-2
fixed
trixie
2:4.21.1+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
heimdal
kinetic
not-affected
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
not-affected
eoan
not-affected
disco
ignored
cosmic
ignored
bionic
Fixed 7.5.0+dfsg-1ubuntu0.1
released
xenial
Fixed 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1
released
trusty
Fixed 1.6~git20131207+dfsg-1ubuntu1.2+esm1
released
samba
kinetic
Fixed 2:4.10.0+dfsg-0ubuntu2.1
released
jammy
Fixed 2:4.10.0+dfsg-0ubuntu2.1
released
focal
Fixed 2:4.10.0+dfsg-0ubuntu2.1
released
disco
Fixed 2:4.10.0+dfsg-0ubuntu2.1
released
cosmic
Fixed 2:4.8.4+dfsg-2ubuntu2.4
released
bionic
Fixed 2:4.7.6+dfsg~ubuntu-0ubuntu2.10
released
xenial
Fixed 2:4.3.11+dfsg-0ubuntu0.16.04.20
released
trusty
Fixed 2:4.3.11+dfsg-0ubuntu0.14.04.20+esm1
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html
http://seclists.org/fulldisclosure/2019/Aug/11
http://seclists.org/fulldisclosure/2019/Aug/13
http://seclists.org/fulldisclosure/2019/Aug/14
http://seclists.org/fulldisclosure/2019/Aug/15
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16860
https://seclists.org/bugtraq/2019/Aug/21
https://seclists.org/bugtraq/2019/Aug/22
https://seclists.org/bugtraq/2019/Aug/23
https://seclists.org/bugtraq/2019/Aug/25
https://security.gentoo.org/glsa/202003-52
https://support.apple.com/HT210346
https://support.apple.com/HT210348
https://support.apple.com/HT210351
https://support.apple.com/HT210353
https://www.samba.org/samba/security/CVE-2018-16860.html
https://www.synology.com/security/advisory/Synology_SA_19_23
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html
http://seclists.org/fulldisclosure/2019/Aug/11
http://seclists.org/fulldisclosure/2019/Aug/13
http://seclists.org/fulldisclosure/2019/Aug/14
http://seclists.org/fulldisclosure/2019/Aug/15
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16860
https://seclists.org/bugtraq/2019/Aug/21
https://seclists.org/bugtraq/2019/Aug/22
https://seclists.org/bugtraq/2019/Aug/23
https://seclists.org/bugtraq/2019/Aug/25
https://security.gentoo.org/glsa/202003-52
https://support.apple.com/HT210346
https://support.apple.com/HT210348
https://support.apple.com/HT210351
https://support.apple.com/HT210353
https://www.samba.org/samba/security/CVE-2018-16860.html
https://www.synology.com/security/advisory/Synology_SA_19_23