Medium severity · published Nov 28, 2018
CVE-2018-16857
Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3…
5.9
CVSS
2.3%
EPSS
No
On KEV
Description
Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Samba · Samba
4.9.0 before 4.9.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16857
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16857
Third Party Advisory
http://www.securityfocus.com/bid/106024
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16857
security.gentoo.org
https://security.gentoo.org/glsa/202003-52
Third Party Advisory
https://security.netapp.com/advisory/ntap-20181127-0001/
Mitigation
https://www.samba.org/samba/security/CVE-2018-16857.html
More from Samba
9.8
CVE-2017-7494
Samba Remote Code Execution Vulnerability
5.5
CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
9.8
CVE-2026-4408
Samba: remote code execution in samr
9.8
CVE-2023-3961
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
9.8
CVE-2022-45141
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable…