6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.011 Low
EPSS
Percentile
84.2%
On a Samba 4 AD DC the LDAP server in all versions of Samba from
4.0.0 onwards incorrectly validates permissions to modify passwords
over LDAP allowing authenticated users to change any other usersβ
passwords, including administrative users and privileged service
accounts (eg Domain Controllers).
The LDAP server incorrectly validates certain LDAP password
modifications against the βChange Passwordβ privilege, but then
performs a password reset operation.
The change password right in AD is an extended object access right
with the GUID ab721a53-1e2f-11d0-9819-00aa0040529b.
By default user objects grant the change password right to the
authenticated userβs own user object (self) and to everyone
(world). Computer objects grant the change password right to
everyone.
The corresponding ACEs expressed in SDDL are
self: (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS)
world: (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD)
The components of these ACEs are
OA: object access allowed
CR: extended rights
PS: trustee: self
WD: trustee: world/everyone
The problematic ACE is the one for world/everyone.
The Windows GUI shows this as βChange passwordβ right granted to
βEveryoneβ.
Possible workarounds are described at a dedicated page in the Samba wiki:
https://wiki.samba.org/index.php/CVE-2018-1057
A patch addressing this defect has been posted to
https://www.samba.org/samba/security/
Additionally, Samba 4.7.6, 4.6.14 and 4.5.16 have been issued as
security releases to correct the defect. Patches against older Samba
versions may be available at https://samba.org/samba/patches/. Samba
vendors and administrators running affected versions are advised to
upgrade or apply the patch as soon as possible.
This problem was found by BjΓΆrn Baumbach from SerNet. Ralph BΓΆhme and
Stefan Metzmacher from SerNet and the Samba Team provided the fix.
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.011 Low
EPSS
Percentile
84.2%