Man-in-the-middle attack in Samba - CVE-2016-2114

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU239

Man-in-the-middle attack in Samba - CVE-2016-2114

Published: July 29, 2016 / Updated: November 22, 2018


Vulnerability identifier: #VU239
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-2114
CWE-ID: CWE-300
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to to bypass security restrictions.

The vulnerability exists due to the failure to enforce required smb signing. A remote unauthenticated attacker can bypass security restrictions by using man-in-the-middle techniques to perform unauthorized actions.

Successful exploitation of this vulnerability may result in security restrictions bypass.

Affected software

Samba
Arch Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Ubuntu
Slackware Linux
Fedora
Red Hat Gluster Storage Server for On-premise
libtevent (Red Hat package)
evolution-mapi (Red Hat package)
openchange (Red Hat package)
libldb (Red Hat package)
libtdb (Red Hat package)
sssd (Red Hat package)
libtalloc (Red Hat package)
samba (Red Hat package)
samba4 (Red Hat package)
samba

How to mitigate CVE-2016-2114

Install Samba 4.4.2, 4.3.8 and 4.2.11.

libtevent (Red Hat package) - addressed in versions 0.9.26-1.el7_1, 0.9.26-1.el6rhs, 0.9.26-1.el7rhgs
evolution-mapi (Red Hat package) - update to 0.28.3-8.el6_2
openchange (Red Hat package) - addressed in versions 1.0-1.el6_2, 1.0-5.el6_4, 1.0-7.el6_5, 1.0-7.el6_6
libldb (Red Hat package) - addressed in versions 1.1.24-1.el6rhs, 1.1.24-1.el7rhgs, 1.1.25-1.el7_1, 1.1.25-2.el6_2, 1.1.25-2.el6_4, 1.1.25-2.el6_5, 1.1.25-2.el6_6
libtdb (Red Hat package) - addressed in versions 1.3.8-1.el7_1, 1.3.8-1.el6rhs, 1.3.8-1.el7rhgs
sssd (Red Hat package) - update to 1.9.2-82.12.el6_4
libtalloc (Red Hat package) - addressed in versions 2.1.5-1.el7_1, 2.1.5-1.el6rhs, 2.1.5-1.el7rhgs
samba (Red Hat package) - addressed in versions 4.2.10-5.el7_1, 4.2.11-2.el6rhs, 4.2.11-2.el7rhgs
samba4 (Red Hat package) - addressed in versions 4.2.10-6.el6_2, 4.2.10-6.el6_4, 4.2.10-6.el6_5, 4.2.10-6.el6_6
samba - addressed in versions 4.2.11-0.fc22, 4.3.8-0.fc23, 4.4.2-1.fc24

External References

Related Security Bulletins