Security restrictions bypass in Oracle products - CVE-2016-2119

Vulnerability identifier: #VU101

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-2119

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to downgrade client signing security controls on the target system.

The vulnerability exists due to state error in Samba. A remote unauthenticated attacker can downgrade the required signing for an SMB2/3 client connection by injecting the SMB2_SESSION_FLAG_IS_GUEST or SMB2_SESSION_FLAG_IS_NULL flags.

Successful exploitation of this vulnerability may result in disclosure of system information.

Samba
Oracle Linux
Oracle Solaris
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Ubuntu
Fedora
Red Hat Gluster Storage Server for On-premise
samba (Alpine package)
samba

The vendor has issued a fix (4.2.14, 4.3.11, 4.4.5).

samba (Alpine package) - update to 4.2.14-r0
samba - addressed in versions 4.3.11-1.fc23, 4.4.5-1.fc24

• https://www.samba.org/samba/security/CVE-2016-2119.html
• http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

• Ubuntu update for Samba
• Slackware Linux update for samba
• Amazon Linux AMI update for samba
• Gentoo update for Samba
• Red Hat update for samba
• Red Hat update for samba
• Security restrictions bypass in samba (Alpine package)
• Fedora 24 update for samba
• Fedora 23 update for samba