0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Samba 4.x Password Change Vulnerability
Author
Risk
[Security Risk Critical
]0day-ID
Category
Date add
CVE
Platform
==================================================================== == Subject: Authenticated users can change other users' password == == CVE ID#: CVE-2018-1057 == == Versions: All versions of Samba from 4.0.0 onwards. == == Summary: On a Samba 4 AD DC any authenticated user can change == other users' passwords over LDAP, including the == passwords of administrative users and service == accounts. == ==================================================================== =========== Description =========== On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers). The LDAP server incorrectly validates certain LDAP password modifications against the "Change Password" privilege, but then performs a password reset operation. The change password right in AD is an extended object access right with the GUID ab721a53-1e2f-11d0-9819-00aa0040529b. By default user objects grant the change password right to the authenticated user's own user object (self) and to everyone (world). Computer objects grant the change password right to everyone. The corresponding ACEs expressed in SDDL are self: (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;PS) world: (OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;WD) The components of these ACEs are OA: object access allowed CR: extended rights PS: trustee: self WD: trustee: world/everyone The problematic ACE is the one for world/everyone. The Windows GUI shows this as "Change password" right granted to "Everyone". ========== Workaround ========== Possible workarounds are described at a dedicated page in the Samba wiki: https://wiki.samba.org/index.php/CVE-2018-1057 ================== Patch Availability ================== A patch addressing this defect has been posted to https://www.samba.org/samba/security/ Additionally, Samba 4.7.6, 4.6.14 and 4.5.16 have been issued as security releases to correct the defect. Patches against older Samba versions may be available at https://samba.org/samba/patches/. Samba vendors and administrators running affected versions are advised to upgrade or apply the patch as soon as possible. ======= Credits ======= This problem was found by BjAPrn Baumbach from SerNet. Ralph BAPhme and Stefan Metzmacher from SerNet and the Samba Team provided the fix. # 0day.today [2024-12-25] #