CVE-2018-16853

Name

CVE-2018-16853

Description

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command.

NVD Severity

medium

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
Vendor Advisory	https://www.samba.org/samba/security/CVE-2018-16853.html
Issue Tracking	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16853
Third Party Advisory	https://security.netapp.com/advisory/ntap-20181127-0001/
Third Party Advisory	http://www.securityfocus.com/bid/106026
GENTOO	https://security.gentoo.org/glsa/202003-52

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:samba:samba::::::::`	samba	>= 4.9.0	< 4.9.3
`cpe:2.3:a:samba:samba::::::::`	samba	>= 4.8.0	< 4.8.7
`cpe:2.3:a:samba:samba::::::::`	samba	>= 4.7.0	< 4.7.12

References

Match rules

Vulnerable and fixed packages