Vulnerability Description
Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | >= 4.9.0, < 4.9.3 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/106024Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16857Issue TrackingMitigationThird Party Advisory
- https://security.gentoo.org/glsa/202003-52
- https://security.netapp.com/advisory/ntap-20181127-0001/Third Party Advisory
- https://www.samba.org/samba/security/CVE-2018-16857.htmlMitigationPatchVendor Advisory
- http://www.securityfocus.com/bid/106024Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16857Issue TrackingMitigationThird Party Advisory
- https://security.gentoo.org/glsa/202003-52
- https://security.netapp.com/advisory/ntap-20181127-0001/Third Party Advisory
- https://www.samba.org/samba/security/CVE-2018-16857.htmlMitigationPatchVendor Advisory
FAQ
What is CVE-2018-16857?
CVE-2018-16857 is a vulnerability with a CVSS score of 7.4 (HIGH). Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch fo...
How severe is CVE-2018-16857?
CVE-2018-16857 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-16857?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Samba.