Improper Authentication in Samba - CVE-2018-16860

Vulnerability identifier: #VU18438

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-16860

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to compromise vulnerable domain.

The vulnerability exists due to an error within the process of obtaining kerberos ticket for a service from the Kerberos Key Distribution Center (KDC) that involves S4U2Self and S4U2Proxy extensions. A remote authenticated user can impersonate another service on the network and obtain elevated privileges within the domain.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable Active Directory implementation.

Samba
Gentoo Linux
Ubuntu
SUSE Linux
Opensuse
Fedora
cflinuxfs3
samba (Alpine package)
samba (Ubuntu package)
samba (Debian package)
heimdal (Alpine package)
firefox-esr (Alpine package)
heimdal-clients-x (Ubuntu package)
heimdal-servers-x (Ubuntu package)
heimdal-clients (Ubuntu package)
libkrb5-26-heimdal (Ubuntu package)
heimdal-servers (Ubuntu package)
libkdc2-heimdal (Ubuntu package)
heimdal-kdc (Ubuntu package)
libgssapi3-heimdal (Ubuntu package)
heimdal-kcm (Ubuntu package)
samba
RoboHelp

Install updates from vendor's website.

Samba - addressed in versions 4.8.12, 4.9.8, 4.10.3
cflinuxfs3 - update to 0.328.0
samba (Alpine package) - update to 4.8.12-r0
samba (Ubuntu package) - addressed in versions 2:4.3.11+dfsg-0ubuntu0.16.04.20, 2:4.7.6+dfsg~ubuntu-0ubuntu2.10, 2:4.8.4+dfsg-2ubuntu2.4, 2:4.10.0+dfsg-0ubuntu2.1
samba (Debian package) - update to 2:4.5.16+dfsg-1+deb9u2
heimdal (Alpine package) - update to 7.4.0-r3
heimdal-clients-x (Ubuntu package) - update to Ubuntu Pro (Infra-only)
heimdal-servers-x (Ubuntu package) - update to Ubuntu Pro (Infra-only)
heimdal-clients (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
libkrb5-26-heimdal (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
heimdal-servers (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
libkdc2-heimdal (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
heimdal-kdc (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
libgssapi3-heimdal (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
heimdal-kcm (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 7.5.0+dfsg-1ubuntu0.1, 7.7.0+dfsg-1ubuntu1.1
samba - addressed in versions 4.9.8-0.fc29, 4.10.3-0.fc30

• https://www.samba.org/samba/security/CVE-2018-16860.html

• Authentication bypass in Samba
• Ubuntu update for Samba
• Debian update for samba
• Gentoo update for Samba
• OpenSUSE Linux update for libheimdal
• OpenSUSE Linux update for libheimdal
• OpenSUSE Linux update for libheimdal
• Improper Authentication in heimdal (Alpine package)
• Improper Authentication in samba (Alpine package)
• Improper Authentication in firefox-esr (Alpine package)
• Ubuntu update for heimdal
• Multiple vulnerabilities in cflinuxfs3
• Fedora 30 update for samba
• Fedora 29 update for samba