CVE-2018-16857 Security feature bypass in samba
Samba Active Directory Domain Controllers may fail to enforce bad password lockout policies, allowing brute-force attacks to bypass security restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16857?
CVE-2018-16857 is a high-severity vulnerability in Samba Samba, published on 28 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.
Weakness: CWE-358
Which versions are affected by CVE-2018-16857?
It affects 1 product.
Products include Samba Samba.
How do I fix CVE-2018-16857?
Upgrade to a fixed version.
Is CVE-2018-16857 being exploited?
There is no known exploitation of CVE-2018-16857 in the wild and no public exploit code.
Other vulnerabilities in Samba Samba
Sources
Also known as DEBIAN-CVE-2018-16857, ECHO-947b-8562-204f, GHSA-qhgj-r7g7-whqw.