CVE-2018-16857

It was found that the 'bad password observation window' was ineffective when set to a value greater than 3 minutes. This could allow for brute force password attacks in some situations. Mitigation Bad password lockout is not configured by default, it is only effective if a threshold has been set...

Bad password count in AD DC not always effective

Description By default, Samba will remember bad passwords for 30min: eg: $ samba-tool domain passwordsettings show ... Reset account lockout after mins: 30 This is also known as the 'bad password observation window' and is configured in the lockOutObservationWindow attribute on the domain DN or i...