CVE-2018-1057

Description

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

References

https://www.samba.org/samba/security/CVE-2018-1057.html

https://bugzilla.redhat.com/show_bug.cgi?id=1553553

https://www.debian.org/security/2018/dsa-4135

https://security.netapp.com/advisory/ntap-20180313-0001/

http://www.securitytracker.com/id/1040494

http://www.securityfocus.com/bid/103382

https://www.synology.com/support/security/Synology_SA_18_08

https://usn.ubuntu.com/3595-1/

https://security.gentoo.org/glsa/201805-07

https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html

Details

Risk Information

CVSS v2

CVSS v3