CVE-2018-16860

Name
CVE-2018-16860
Description
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16860
Mitigation https://www.samba.org/samba/security/CVE-2018-16860.html
BUGTRAQ https://seclists.org/bugtraq/2019/Aug/21
BUGTRAQ https://seclists.org/bugtraq/2019/Aug/23
BUGTRAQ https://seclists.org/bugtraq/2019/Aug/25
BUGTRAQ https://seclists.org/bugtraq/2019/Aug/22
SUSE http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html
FULLDISC http://seclists.org/fulldisclosure/2019/Aug/13
FULLDISC http://seclists.org/fulldisclosure/2019/Aug/14
FULLDISC http://seclists.org/fulldisclosure/2019/Aug/11
FULLDISC http://seclists.org/fulldisclosure/2019/Aug/15
CONFIRM https://www.synology.com/security/advisory/Synology_SA_19_23
CONFIRM https://support.apple.com/HT210346
CONFIRM https://support.apple.com/HT210348
CONFIRM https://support.apple.com/HT210351
CONFIRM https://support.apple.com/HT210353
GENTOO https://security.gentoo.org/glsa/202003-52

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.10.0 < 4.10.3
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.8.0 < 4.8.12
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* samba >= 4.9.0 < 4.9.8

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
samba edge-main 4.10.3-r0 None fixed
samba edge-main 4.8.11-r0 None possibly vulnerable
samba edge-main 4.8.7-r0 None possibly vulnerable
samba edge-main 4.8.4-r0 None possibly vulnerable
samba 3.22-main 4.10.3-r0 None fixed
samba 3.22-main 4.8.11-r0 None possibly vulnerable
samba 3.22-main 4.8.7-r0 None possibly vulnerable
samba 3.22-main 4.8.4-r0 None possibly vulnerable
samba 3.21-main 4.10.3-r0 None fixed
samba 3.21-main 4.8.11-r0 None possibly vulnerable
samba 3.21-main 4.8.7-r0 None possibly vulnerable
samba 3.21-main 4.8.4-r0 None possibly vulnerable
samba 3.20-main 4.10.3-r0 None fixed
samba 3.20-main 4.8.11-r0 None possibly vulnerable
samba 3.20-main 4.8.7-r0 None possibly vulnerable
samba 3.20-main 4.8.4-r0 None possibly vulnerable
samba 3.19-main 4.10.3-r0 None fixed
samba 3.19-main 4.8.11-r0 None possibly vulnerable
samba 3.19-main 4.8.7-r0 None possibly vulnerable
samba 3.19-main 4.8.4-r0 None possibly vulnerable
samba 3.18-main 4.10.3-r0 None fixed
samba 3.17-main 4.10.3-r0 None fixed
samba 3.12-main 4.10.3-r0 None fixed
samba 3.11-main 4.10.3-r0 None fixed
samba 3.10-main 4.10.3-r0 None fixed
heimdal edge-main 7.5.3-r4 None fixed
heimdal 3.22-main 7.5.3-r4 None fixed
heimdal 3.21-main 7.5.3-r4 None fixed
heimdal 3.20-main 7.5.3-r4 None fixed
heimdal 3.19-main 7.5.3-r4 None fixed
heimdal 3.18-main 7.5.3-r4 None fixed
heimdal 3.17-main 7.5.3-r4 None fixed
heimdal 3.12-main 7.5.3-r4 None fixed
heimdal 3.11-main 7.5.3-r4 None fixed
heimdal 3.10-main 7.5.0-r4 None fixed