CVE-2018-16853

Name: CVE-2018-16853
Creator: NVD / NIST
Published: 2018-11-28T14:29:00.533+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 3.08%

Last modified Jun 17, 2026

CVE-2018-16853 is a vulnerability of currently unknown severity. Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. EPSS estimates a 3.08% chance of exploitation in the next 30 days.

Description

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command.

Metrics

EPSS Probability

3.08%

86.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Samba	Samba	>= 4.7.0, < 4.7.12
Samba	Samba	>= 4.8.0, < 4.8.7
Samba	Samba	>= 4.9.0, < 4.9.3

References

http://www.securityfocus.com/bid/106026Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16853Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202003-52
https://security.netapp.com/advisory/ntap-20181127-0001/Third Party Advisory
https://www.samba.org/samba/security/CVE-2018-16853.htmlVendor Advisory
http://www.securityfocus.com/bid/106026Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16853Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202003-52
https://security.netapp.com/advisory/ntap-20181127-0001/Third Party Advisory
https://www.samba.org/samba/security/CVE-2018-16853.htmlVendor Advisory

Timeline

Published: Nov 28, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-16853?

How severe is CVE-2018-16853?

Severity scoring for CVE-2018-16853 is pending analysis. The EPSS model estimates a 3.08% probability of exploitation in the next 30 days.

How do I fix CVE-2018-16853?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-16853?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST