CVE-2018-1057: High severity Canonical Ubuntu Linux vulnerability
As per samba upstream advisory:
On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users passwords, including administrative users.
Other sources
On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1057?
CVE-2018-1057 is considered a critical vulnerability due to its potential for unauthorized password changes by authenticated users.
How do I fix CVE-2018-1057?
To fix CVE-2018-1057, update Samba to a version that is not affected, specifically versions 4.13.14 or higher, 4.17.13 or higher, or 4.21.1 or higher.
What are the affected versions of Samba for CVE-2018-1057?
CVE-2018-1057 affects all versions of Samba from 4.0.0 to 4.11.x, including specific subversions of those series.
What systems are impacted by CVE-2018-1057?
CVE-2018-1057 impacts systems running Samba on various distributions including Debian and Ubuntu versions 14.04, 16.04, and 17.10.
Can authenticated users exploit CVE-2018-1057?
Yes, authenticated users can exploit CVE-2018-1057 to change passwords of any user, including administrative accounts.