CVE-2018-1057

Description

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

References

https://www.synology.com/support/security/Synology_SA_18_08

https://www.samba.org/samba/security/CVE-2018-1057.html

https://www.debian.org/security/2018/dsa-4135

https://usn.ubuntu.com/3595-1/

https://security.netapp.com/advisory/ntap-20180313-0001/

https://security.gentoo.org/glsa/201805-07

https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html

https://bugzilla.redhat.com/show_bug.cgi?id=1553553

http://www.securitytracker.com/id/1040494

http://www.securityfocus.com/bid/103382

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3