CVE-2018-1057: Unprivileged user can change any user (and admin) password

Caveats and further info here

https://wiki.samba.org/index.php/CVE-2018-1057

 

Yep, that's a big one.

Do you think there will be security release on the "Stable" branch 6.4.x? Or will only the "really chaos" branch 6.5.x see the fix?

Note that the issue is when Samba is used as AD domain controller. So most users aren't affected.

I suspect it affects almost nobody?     Even when we hear about unRAID being used in an AD context it is normally about unRAID joining an AD domain (i.e. unRAID is not the AD controller).

Fixed in 6.5.0 I'm pretty sure. From the release notes:

 

• samba: version 4.7.6 (CVE-2018-1050, CVE-2018-1057)

This does not apply to unRAID and now that 6.5.0 is out, 6.4.x is EOS.