CVE-2018-16857: High severity samba vulnerability
Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-16857?
CVE-2018-16857 is considered a critical vulnerability due to its potential to allow an attacker to bypass bad password checks.
How do I fix CVE-2018-16857?
To fix CVE-2018-16857, you should upgrade your Samba installation to version 4.9.3 or later.
What versions of Samba are affected by CVE-2018-16857?
CVE-2018-16857 affects Samba versions from 4.9.0 up to but not including 4.9.3.
What are the implications of CVE-2018-16857 in an AD DC configuration?
In an AD DC configuration, CVE-2018-16857 can lead to an increased risk of brute force attacks due to a failure to monitor bad password attempts.
Is there a workaround for CVE-2018-16857?
While upgrading is the recommended solution, implementing stricter password policies may help mitigate some risks associated with CVE-2018-16857.