Wind River Support Network

Home CVE Database CVE-2018-1057

CVE-2018-1057

Description

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users\' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Priority: MEDIUM

CVSS v3: 8.8

Component: samba

Publish Date: Mar 13, 2018

Related ID: --

CVSS v2: HIGH

Modified Date: Mar 13, 2018

Find out more about CVE-2018-1057 from the MITRE-CVE dictionary and NIST NVD

Products Affected

Product Name	Status	Defect	Fixed	Downloads
Linux
Wind River Linux LTS 17	Fixed	LIN10-3534	10.17.41.7	Wind River Linux LTS 10.17.41.7 Wind River Linux LTS 10.17.41.8 Wind River Linux LTS 10.17.41.9 Wind River Linux LTS 10.17.41.10 Wind River Linux LTS 10.17.41.11 Wind River Linux LTS 10.17.41.12 Wind River Linux LTS 10.17.41.13 Wind River Linux LTS 10.17.41.14 Wind River Linux LTS 10.17.41.15 Wind River Linux LTS 10.17.41.16 Wind River Linux LTS 10.17.41.17 Wind River Linux LTS 10.17.41.18 Wind River Linux LTS 10.17.41.20 Wind River Linux LTS 10.17.41.21 Wind River Linux LTS 10.17.41.22 Wind River Linux LTS 10.17.41.23 Wind River Linux LTS 10.17.41.24 Wind River Linux LTS 10.17.41.25 Wind River Linux LTS 10.17.41.26 Wind River Linux LTS 10.17.41.27
Wind River Linux 8	Fixed	LIN8-8881	8.0.0.26	--
Wind River Linux 9	Fixed	LIN9-6556	9.0.0.16	--
Wind River Linux 7	Fixed	--	7.0.0.29	--
Wind River Linux LTS 21	Not Vulnerable	--	--	--
Wind River Linux LTS 22	Not Vulnerable	--	--	--
Wind River Linux LTS 18	Not Vulnerable	--	--	--
Wind River Linux LTS 19	Not Vulnerable	--	--	--
Wind River Linux CD release	Not Vulnerable	--	--	--
Wind River Linux 6	Fixed	--	6.0.0.37	--
VxWorks
VxWorks 7	Not Vulnerable	--	--	--
VxWorks 6.9	Not Vulnerable	--	--	--

Related Products

Product Name	Status	Defect	Fixed	Downloads

Notes
Requires LTSS - customers must have active LTSS (Long Term Security Shield) Support to receive up-to-date information about vulnerabilities that may affect legacy software. Please contact your Wind River account team or see https://docs.windriver.com/bundle/Support_and_Maintenance_Supplemental_Terms_and_Conditions and https://support2.windriver.com/index.php?page=plc for more information.