Critical Vulnerability in Heimdal and Samba Packages: CVE-2018-16860
Summary
ALPINE-CVE-2018-16860: A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. Affects heimdal versions < 7.5.0-r4. Fixed in 7.5.0-r4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Heimdal is an open-source implementation of Kerberos 5, providing authentication services for networked applications. Samba is a software suite that enables file and print services to SMB/CIFS clients. Both packages are widely used in enterprise environments for secure authentication and resource sharing. The vulnerability identified as CVE-2018-16860 affects specific versions of Heimdal and Samba when used in Active Directory Domain Controller (AD DC) mode, allowing attackers to exploit weaknesses in the Kerberos Key Distribution Center (KDC) implementation.
Vulnerability Detail
A flaw was found in the KDC implementation of Samba's Heimdal, affecting versions 4.8.x (up to, excluding 4.8.12), 4.9.x (up to, excluding 4.9.8), and 4.10.x (up to, excluding 4.10.3). This vulnerability allows a man-in-the-middle attacker to intercept requests to the KDC and replace the username in the request with any existing username in the KDC. This could lead to unauthorized access, as the attacker could obtain a ticket for that principal, compromising the security of the system.
How To Fix
Minimum fixed version
7.5.0-r4
This is the first release that contains the fix.
sudo apk add --upgrade heimdalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider isolating the affected services from untrusted networks to mitigate the risk of man-in-the-middle attacks. Additionally, monitor network traffic for suspicious activity.
Conclusion
The CVE-2018-16860 vulnerability poses a significant risk to systems using Heimdal and Samba in AD DC mode. It is crucial to apply the recommended patches promptly to safeguard against potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for heimdal →
FAQ
CVE-2018-16860 is a vulnerability in the Heimdal and Samba packages that allows attackers to intercept and manipulate authentication requests.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access to sensitive resources, as attackers can obtain Kerberos tickets for any user in the KDC.
Yes, patches are available for both Heimdal and Samba. Ensure you update to the specified patched versions to mitigate the risk.
If you cannot patch immediately, consider implementing network isolation for the affected services and monitoring for unusual activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for heimdal.
