CVE-2018-1057

Опубликовано: 13 мар. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Средний

Описание

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Ссылки

http://www.securityfocus.com/bid/103382
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040494
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1553553
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201805-07
Third Party Advisory
https://security.netapp.com/advisory/ntap-20180313-0001/
Third Party Advisory
https://usn.ubuntu.com/3595-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4135
Third Party Advisory
https://www.samba.org/samba/security/CVE-2018-1057.html
Mitigation
Vendor Advisory
https://www.synology.com/support/security/Synology_SA_18_08
Third Party Advisory
http://www.securityfocus.com/bid/103382
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040494
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1553553
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/201805-07
Third Party Advisory
https://security.netapp.com/advisory/ntap-20180313-0001/
Third Party Advisory
https://usn.ubuntu.com/3595-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4135
Third Party Advisory
https://www.samba.org/samba/security/CVE-2018-1057.html
Mitigation
Vendor Advisory
https://www.synology.com/support/security/Synology_SA_18_08
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:lts:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.0.0 (включая) до 4.5.16 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.6.0 (включая) до 4.6.14 (исключая)

cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Версия от 4.7.0 (включая) до 4.7.6 (исключая)

EPSS

Процентиль: 95%

0.10105

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-863

Связанные уязвимости

CVE-2018-1057

CVSS3: 8.8

ubuntu

больше 8 лет назад

CVE-2018-1057

CVSS3: 7.4

redhat

больше 8 лет назад

CVE-2018-1057

CVSS3: 8.8

msrc

больше 4 лет назад

Описание отсутствует

CVE-2018-1057

CVSS3: 8.8

debian

больше 8 лет назад

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 ...

openSUSE-SU-2018:1727-1

suse-cvrf

около 8 лет назад

Security update for samba

EPSS

Процентиль: 95%

0.10105

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-863