High severity · published Jul 31, 2019
CVE-2018-16860
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC…
7.5
CVSS
2.5%
EPSS
No
On KEV
Description
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Heimdal · Heimdal Project
0.8 through 7.5.0 · source: NVD
SA
Samba · Samba
4.8.0 before 4.8.12; 4.9.0 before 4.9.8; 4.10.0 before 4.10.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16860
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html
seclists.org
http://seclists.org/fulldisclosure/2019/Aug/11
seclists.org
http://seclists.org/fulldisclosure/2019/Aug/13
seclists.org
http://seclists.org/fulldisclosure/2019/Aug/14
seclists.org
http://seclists.org/fulldisclosure/2019/Aug/15
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16860
More from Heimdal
9.8
CVE-2022-44640
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC)
9.8
CVE-2004-0434
k5admind (kadmind) for Heimdal allows remote attackers to execute arbitrary code via a Kerberos 4 compatibility administration request whose framing length is less than 2, which…
8.8
CVE-2022-42898
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos…
8.1
CVE-2017-11103
Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5…
7.5
CVE-2022-3116
The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance