{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2018-16860 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2018-16860 is a high-severity authentication bypass vulnerability in Samba Samba, published on 31 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2018-16860 and fix it if it is affected.\n\nWhat it is: CVE-2018-16860 is a high-severity authentication bypass vulnerability in Samba Samba, published on 31 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2018-16860 in the wild and no public exploit code.\n\nAffected product: Samba Samba. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2018-16860/ (Markdown: https://insights.sbomify.com/CVE-2018-16860/index.md)","id":"CVE-2018-16860","markdown":"https://insights.sbomify.com/CVE-2018-16860/index.md","name":"CVE-2018-16860","record":{"aliases":["ALPINE-CVE-2018-16860","CLEANSTART-2024-BH94102","DEBIAN-CVE-2018-16860","DLA-1788-1","DSA-4443-1","ECHO-9cf7-2c5d-dcf9","GHSA-282x-mj8h-7q8w","UBUNTU-CVE-2018-16860","USN-3976-1","USN-3976-2"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["privilege_escalation","account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Samba AD DC","requires_auth":"low_privilege","summary":"A man-in-the-middle attacker can intercept KDC requests in Samba AD DC mode to impersonate any user and obtain their authentication tickets.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"heimdal","vendor":"heimdal_project"},{"product":"samba","vendor":"samba"}],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"cwes":[{"id":"CWE-358","name":"Improperly Implemented Security Check for Standard"}],"description":"A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Auth bypass in samba","id":"CVE-2018-16860","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"samba:samba","products":["samba:samba"],"type":"auth_bypass","year":"2018"},"n_packages":0,"n_references":17,"next":{"headline":"Cross-site scripting in foreman","id":"CVE-2018-16861"},"packages":[],"prev":{"headline":"Ansible Logs Passwords If PowerShell ScriptBlock is Enabled","id":"CVE-2018-16859"},"products":["samba"],"published":"2019-07-31","related":[{"cvss_score":9.8,"headline":"Use after free in n/a","id":"CVE-2022-44640","kev_date_added":null,"published":"2022-12-25"},{"cvss_score":8.8,"headline":"Integer overflow in n/a","id":"CVE-2022-42898","kev_date_added":null,"published":"2022-12-25"},{"cvss_score":7.5,"headline":"Null dereference in Heimdal Software Kerberos","id":"CVE-2022-3116","kev_date_added":null,"published":"2023-03-27"},{"cvss_score":7.5,"headline":"Security feature bypass in Samba","id":"CVE-2022-45142","kev_date_added":null,"published":"2023-03-06"},{"cvss_score":7.5,"headline":"Null dereference in n/a","id":"CVE-2021-44758","kev_date_added":null,"published":"2022-12-26"},{"cvss_score":7.5,"headline":"Security feature bypass in n/a","id":"CVE-2017-6594","kev_date_added":null,"published":"2017-08-28"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-05","vendors":["SAMBA"]},"summary":"A man-in-the-middle attacker can intercept KDC requests in Samba AD DC mode to impersonate any user and obtain their authentication tickets.","url":"https://insights.sbomify.com/CVE-2018-16860/"}