CVE-2018-16857

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-358

Affected software

No affected versions have been published.

Timeline

Published: Nov 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-168589.8It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute CVE-2018-168594.4Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' pa CVE-2018-16865.4IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java CVE-2018-168607.5A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up t CVE-2018-168614.8A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Ho CVE-2018-168625.5A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (remova CVE-2018-168637.8It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass CVE-2018-168647.8An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journa CVE-2018-168657.8An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journa CVE-2018-168663.3An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker CVE-2018-168677.8A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/us CVE-2018-168685.6A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5