Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2018-16860 →
DEBIAN-CVE-2018-16860
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excludi...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3, when used in AD DC mode. A man in the middle attacker could use this flaw to intercept the request to the KDC and replace the user name (principal) in the request with any desired user name (principal) that exists in the KDC effectively obtaining a ticket for that principal.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
heimdal
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-3"}]}]
Debian:13
heimdal
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-3"}]}]
Debian:14
heimdal
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-3"}]}]
Debian:12
samba
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9.5+dfsg-4"}]}]
Debian:13
samba
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9.5+dfsg-4"}]}]
Debian:14
samba
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.9.5+dfsg-4"}]}]
Références
- advisory security-tracker.debian.org