CVE-2018-16860 Auth bypass in samba

High 7.5 Published 31 Jul 2019 Updated 5 Aug 2024

A man-in-the-middle attacker can intercept KDC requests in Samba AD DC mode to impersonate any user and obtain their authentication tickets.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-16860?

CVE-2018-16860 is a high-severity authentication bypass vulnerability in Samba Samba, published on 31 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.

Weakness: CWE-358

Which versions are affected by CVE-2018-16860?

It affects 2 products.

Products include Heimdal Project Heimdal, Samba Samba.

How do I fix CVE-2018-16860?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-16860 being exploited?

There is no known exploitation of CVE-2018-16860 in the wild and no public exploit code.

All Samba Samba vulnerabilities

Sources

Also known as ALPINE-CVE-2018-16860, CLEANSTART-2024-BH94102, DEBIAN-CVE-2018-16860, DLA-1788-1, DSA-4443-1, ECHO-9cf7-2c5d-dcf9 and 4 more.