Man-in-the-Middle attack in Samba - CVE-2017-12150

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU8516

Man-in-the-Middle attack in Samba - CVE-2017-12150

Published: September 20, 2017


Vulnerability identifier: #VU8516
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12150
CWE-ID: CWE-310
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to several Samba tools do not require signing for SMB connections. The affected tools are:
- 'smb2mount -e', 'smbcacls -e' and 'smbcquotas -e',;
- the python binding exported as 'samba.samba3.libsmb_samba_internal' doesn't make use of the "client signing" smb.conf option;
- libgpo as well as 'net ads gpo' doesn't require SMB signing when fetching group policies
- commandline tools like 'smbclient', 'smbcacls' and 'smbcquotas' allow a fallback to an anonymous connection when using the '--use-ccache' option and this happens even if SMB signing is required.

Successful exploitation of the vulnerability may allow an attacker to perform MitM attack and gain access to potentially sensitive information or elevate privileges on the server.

Affected software

Samba
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
Ubuntu
Slackware Linux
Fedora
Red Hat Gluster Storage Server for On-premise
samba (Alpine package)
samba
RoboHelp

How to mitigate CVE-2017-12150


samba (Alpine package) - update to 4.4.16-r0
samba - addressed in versions 4.5.14-0.fc25, 4.6.8-0.fc26, 4.7.0-12.fc27

External References

Related Security Bulletins