CVE-2018-1057

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Link	Resource
https://www.samba.org/samba/security/CVE-2018-1057.html	Mitigation Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1553553	Issue Tracking Third Party Advisory
https://www.debian.org/security/2018/dsa-4135	Third Party Advisory
https://security.netapp.com/advisory/ntap-20180313-0001/	Third Party Advisory
http://www.securitytracker.com/id/1040494	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/103382	Third Party Advisory VDB Entry
https://www.synology.com/support/security/Synology_SA_18_08	Third Party Advisory
https://usn.ubuntu.com/3595-1/	Third Party Advisory
https://security.gentoo.org/glsa/201805-07	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:lts:*:*:* cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

---

Published : 2018-03-13 04:29

Updated : 2022-08-29 08:11

---

NVD link : CVE-2018-1057

Mitre link : CVE-2018-1057

No products.

CWE-863