CVE-2018-16857

    Dashboard / Vulnerabilities / CVE-2018-16857

    CVE-2018-16857

    Published: 28 Nov 2018Last Modified: 8 Jul 2026

    Summary:

    Details: Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.

    References: http://www.securityfocus.com/bid/106024, https://security.gentoo.org/glsa/202003-52, https://security.netapp.com/advisory/ntap-20181127-0001/, https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16857, https://www.samba.org/samba/security/CVE-2018-16857.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4fc4ae2924aaa2fc184b7385069274526fa8a4c2
    Fixed -40c057c900a9367e8020c943d29547ea8942212f

    Affected versions

    samba-4.9.2
    samba-4.9.1
    samba-4.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High