Improper authentication in Samba - CVE-2016-2125

Vulnerability identifier: #VU6628

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-2125

CWE-ID: CWE-287

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker on the local network to bypass Kerberos authentication.

The vulnerability exists due to design error when implementing Kerberos authentication. An attacker with access to local network can place a fake Samba server, intercept a valid general purpose Kerberos "Ticket Granting Ticket" (TGT) and fully impersonate the authenticated user or service.

Successful exploitation of the vulnerability may allow an attacker to bypass authentication process and gain access to otherwise restricted resources and services.

Samba
Amazon Linux AMI
Arch Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
CentOS
Red Hat Enterprise Linux for x86_64
Ubuntu
Slackware Linux
Fedora
Red Hat Gluster Storage Server for On-premise
samba (Alpine package)
samba

The vulnerability is patched in versions 4.5.3, 4.4.8 and 4.3.13.

samba (Alpine package) - update to 4.2.14-r1
samba - addressed in versions 4.4.8-0.fc24, 4.4.9-0.fc24, 4.5.3-0.fc25

• https://www.samba.org/samba/security/CVE-2016-2125.html

• Red Hat update for samba
• Multiple vulnerabilities in Samba
• CentOS update for samba
• Amazon Linux AMI update for samba
• Arch Linux update for samba
• Ubuntu update for Samba
• Slackware Linux update for samba
• Red Hat update for Red Hat Gluster Storage 3.2.0 samba
• Red Hat update for Red Hat Gluster Storage 3.2.0 samba
• Red Hat update for samba4
• Red Hat update for samba
• Improper authentication in samba (Alpine package)
• Fedora 25 update for samba
• Fedora 24 update for samba
• Fedora 24 update for samba