CVE-2018-16860
High
Description
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSamba
PublishedJul 31, 2019
First seenJul 31, 2019
Weakness typeCWE-358CWE-358
How to fix
Update
- samba samba4.8.12, 4.9.8, 4.10.3 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba samba | 4.8.0 ≤ v < 4.8.12, 4.9.0 ≤ v < 4.9.8, 4.10.0 ≤ v < 4.10.3 | 4.8.12, 4.9.8, 4.10.3 |
| heimdal_project heimdal | 0.8 ≤ v ≤ 7.5.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.