CVE-2018-14628: Fwd: Samba 4.19.3 Available for Download - addresses CVE-2018-14628
All versions of Samba from 4.0.0 onwards are vulnerable to an information leak (compared with the established behaviour of Microsoft's Active Directory) when Samba is an Active Directory Domain Controller.
Missing access control checks on the LDAPSERVERSHOWDELETEDOID control in the DSDB database layer cause the LDAP server to disclose, to authenticated but not privileged users, the names and preserved attributes of deleted objects. (Microsoft AD simply does not return these objects on a search).
No information that was hidden before the deletion is visible, but in Microsoft Active Directory the whole object is also not visible without administrative rights, whereas Samba allows read of limited set of attributes that are preserved after delete.
Other sources
An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this information leak vulnerability?
The vulnerability ID of this information leak vulnerability is CVE-2018-14628.
What is the affected software for this vulnerability?
The affected software for this vulnerability is Samba and Fedora.
What is the severity rating of CVE-2018-14628?
The severity rating of CVE-2018-14628 is medium (4.3).
How can an attacker exploit this vulnerability?
An authenticated but unprivileged attacker could exploit this vulnerability by discovering the names and preserved attributes of deleted objects in the LDAP store.
Are there any references for this vulnerability?
Yes, you can find references for this vulnerability at the following URLs: - [https://bugzilla.samba.org/show_bug.cgi?id=13595](https://bugzilla.samba.org/show_bug.cgi?id=13595) - [https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2160799](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2160799) - [https://bugzilla.redhat.com/show_bug.cgi?id=1625445](https://bugzilla.redhat.com/show_bug.cgi?id=1625445)