CVE-2016-2114
published 2016-04-25CVE-2016-2114: The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory"…
PriorityP430medium5.9CVSS 3.0
AVNACHPRNUINSUCNIHAN
EPSS
2.60%
83.7th percentile
The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.
Affected
82 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | samba | < samba 2:4.3.7+dfsg-1 (bookworm) | samba 2:4.3.7+dfsg-1 (bookworm) |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
| samba | samba | — | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Samba regression
vendor_ubuntu·2016-05-25·CVSS 5.9
[MEDIUM] Samba regression
Title: Samba regression
Summary: USN-2950-1 introduced a regression in Samba.
USN-2950-1 fixed vulnerabilities in Samba. USN-2950-3 updated Samba to
version 4.3.9, which introduced a regression when using the ntlm_auth tool.
This update fixes the problem.
Original advisory details:
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015-5370)
Stefan Metzmacher discovered that Samba contained multiple flaws in the
NTLMSSP authentication implementation. A remote attacker could use this
issue to downgrade connections to plain text by performing a
machine-in-the-
Ubuntu
Samba regressions
vendor_ubuntu·2016-05-18·CVSS 5.9
[MEDIUM] Samba regressions
Title: Samba regressions
Summary: USN-2950-1 introduced regressions in Samba.
USN-2950-1 fixed vulnerabilities in Samba. The backported fixes introduced
in Ubuntu 12.04 LTS caused interoperability issues. This update fixes
compatibility with certain NAS devices, and allows connecting to Samba 3.6
servers by relaxing the "client ipc signing" parameter to "auto".
We apologize for the inconvenience.
Original advisory details:
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015-5370)
Stefan Metzmacher discovered that Samba contained multiple flaws in the
NTL
Ubuntu
libsoup update
vendor_ubuntu·2016-05-04·CVSS 5.9
[MEDIUM] libsoup update
Title: libsoup update
Summary: This update fixes libsoup NTLM authentication.
USN-2950-1 fixed vulnerabilities in Samba. The updated Samba packages
introduced a compatibility issue with NTLM authentication in libsoup. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015-5370)
Stefan Metzmacher discovered that Samba contained multiple flaws in the
NTLMSSP authentication implementation. A remote attacker could use this
issue to downgrade connections to plain text b
Ubuntu
Samba regressions
vendor_ubuntu·2016-05-04·CVSS 5.9
[MEDIUM] Samba regressions
Title: Samba regressions
Summary: USN-2950-1 introduced regressions in Samba.
USN-2950-1 fixed vulnerabilities in Samba. The fixes introduced in Samba
4.3.8 caused certain regressions and interoperability issues.
This update resolves some of these issues by updating to Samba 4.3.9 in
Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. Backported regression
fixes were added to Samba 3.6.25 in Ubuntu 12.04 LTS.
This advisory was inadvertently published as USN-2950-2 originally.
Original advisory details:
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015
Ubuntu
Samba vulnerabilities
vendor_ubuntu·2016-04-18·CVSS 5.9
CVE-2015-5370 [MEDIUM] Samba vulnerabilities
Title: Samba vulnerabilities
Summary: Several security issues were fixed in Samba.
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015-5370)
Stefan Metzmacher discovered that Samba contained multiple flaws in the
NTLMSSP authentication implementation. A remote attacker could use this
issue to downgrade connections to plain text by performing a
machine-in-the-middle attack. (CVE-2016-2110)
Alberto Solino discovered that a Samba domain controller would establish a
secure connection to a server with a spoofed computer name. A remote
attacker could use this is
Red Hat
samba: Samba based active directory domain controller does not enforce smb signing
vendor_redhat·2016-04-12·CVSS 5.9
CVE-2016-2114 [MEDIUM] CWE-300 samba: Samba based active directory domain controller does not enforce smb signing
samba: Samba based active directory domain controller does not enforce smb signing
The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.
It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a server.
Package: samba (Red Hat Enterprise Linux 4) - Not affected
Package: samba (Red Hat Enterprise Linux 5) - Not affected
Package: samba3x (Red Hat Enterprise Linux 5) - Not affected
Package: samba (Red Hat Enterprise Linux 6) -
Debian
CVE-2016-2114: samba - The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8,...
vendor_debian·2016·CVSS 5.9
CVE-2016-2114 [MEDIUM] CVE-2016-2114: samba - The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8,...
The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.
Scope: local
bookworm: resolved (fixed in 2:4.3.7+dfsg-1)
bullseye: resolved (fixed in 2:4.3.7+dfsg-1)
forky: resolved (fixed in 2:4.3.7+dfsg-1)
sid: resolved (fixed in 2:4.3.7+dfsg-1)
trixie: resolved (fixed in 2:4.3.7+dfsg-1)
GHSA
GHSA-qg5v-7xq3-qwf4: The SMB1 protocol implementation in Samba 4
ghsa_unreviewed·2022-05-17
CVE-2016-2114 [MEDIUM] GHSA-qg5v-7xq3-qwf4: The SMB1 protocol implementation in Samba 4
The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.
OSV
samba regression
osv·2016-05-25·CVSS 5.9
[MEDIUM] samba regression
samba regression
USN-2950-1 fixed vulnerabilities in Samba. USN-2950-3 updated Samba to
version 4.3.9, which introduced a regression when using the ntlm_auth tool.
This update fixes the problem.
Original advisory details:
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015-5370)
Stefan Metzmacher discovered that Samba contained multiple flaws in the
NTLMSSP authentication implementation. A remote attacker could use this
issue to downgrade connections to plain text by performing a
machine-in-the-middle attack. (CVE-2016-2110)
Alberto Solino discovered that
OSV
samba regressions
osv·2016-05-04·CVSS 5.9
[MEDIUM] samba regressions
samba regressions
USN-2950-1 fixed vulnerabilities in Samba. The fixes introduced in Samba
4.3.8 caused certain regressions and interoperability issues.
This update resolves some of these issues by updating to Samba 4.3.9 in
Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. Backported regression
fixes were added to Samba 3.6.25 in Ubuntu 12.04 LTS.
This advisory was inadvertently published as USN-2950-2 originally.
Original advisory details:
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015-5370)
Stefan Metzmacher discovered that Samba contained mul
OSV
libsoup2.4 update
osv·2016-05-04·CVSS 5.9
[MEDIUM] libsoup2.4 update
libsoup2.4 update
USN-2950-1 fixed vulnerabilities in Samba. The updated Samba packages
introduced a compatibility issue with NTLM authentication in libsoup. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015-5370)
Stefan Metzmacher discovered that Samba contained multiple flaws in the
NTLMSSP authentication implementation. A remote attacker could use this
issue to downgrade connections to plain text by performing a
machine-in-the-middle attack. (CVE-2016-2110)
OSV
CVE-2016-2114: The SMB1 protocol implementation in Samba 4
osv·2016-04-25·CVSS 5.9
CVE-2016-2114 [MEDIUM] CVE-2016-2114: The SMB1 protocol implementation in Samba 4
The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.
OSV
samba vulnerabilities
osv·2016-04-18·CVSS 5.9
CVE-2015-5370 [MEDIUM] samba vulnerabilities
samba vulnerabilities
Jouni Knuutinen discovered that Samba contained multiple flaws in the
DCE/RPC implementation. A remote attacker could use this issue to perform
a denial of service, downgrade secure connections by performing a
machine-in-the-middle attack, or possibly execute arbitrary code.
(CVE-2015-5370)
Stefan Metzmacher discovered that Samba contained multiple flaws in the
NTLMSSP authentication implementation. A remote attacker could use this
issue to downgrade connections to plain text by performing a
machine-in-the-middle attack. (CVE-2016-2110)
Alberto Solino discovered that a Samba domain controller would establish a
secure connection to a server with a spoofed computer name. A remote
attacker could use this issue to obtain sensitive information.
(CVE-2016-2111)
Stefan M
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws [fedora-all]
bugzilla·2016-04-12·CVSS 5.9
CVE-2015-5370 [MEDIUM] CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws [fedora-all]
CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commi
Bugzilla
CVE-2016-2114 samba: Samba based active directory domain controller does not enforce smb signing
bugzilla·2016-02-25·CVSS 5.9
CVE-2016-2114 [MEDIUM] CVE-2016-2114 samba: Samba based active directory domain controller does not enforce smb signing
CVE-2016-2114 samba: Samba based active directory domain controller does not enforce smb signing
It was found that Samba based active directory domain controller does not enforce smb signing and opens possibility for man-in-the-middle attacks.
When Samba is configured as a Domain Controller, the default for the "server signing" should be "mandatory". During the early development of Samba 4 a new experimental file server located under source4/smb_server was used. But before the final 4.0.0 release upstream switched back to the file server under source3/smbd. But the logic for the correct default of "server signing" was not ported.
Currently all Samba versions >= 4.0.0 are affected.
Upstream bug:
https://bugzilla.samba.org/show_bug.cgi?id=11687
Discussion:
Acknowledgements:
Name: the
http://badlock.org/http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0612.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0614.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0618.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0620.htmlhttp://www.debian.org/security/2016/dsa-3548http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/86011http://www.securitytracker.com/id/1035533http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012http://www.ubuntu.com/usn/USN-2950-1http://www.ubuntu.com/usn/USN-2950-2http://www.ubuntu.com/usn/USN-2950-3http://www.ubuntu.com/usn/USN-2950-4http://www.ubuntu.com/usn/USN-2950-5https://bto.bluecoat.com/security-advisory/sa122https://security.gentoo.org/glsa/201612-47https://www.samba.org/samba/history/samba-4.2.10.htmlhttps://www.samba.org/samba/latest_news.html#4.4.2https://www.samba.org/samba/security/CVE-2016-2114.htmlhttp://badlock.org/http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0612.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0614.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0618.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0620.htmlhttp://www.debian.org/security/2016/dsa-3548http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/86011http://www.securitytracker.com/id/1035533http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012http://www.ubuntu.com/usn/USN-2950-1http://www.ubuntu.com/usn/USN-2950-2http://www.ubuntu.com/usn/USN-2950-3http://www.ubuntu.com/usn/USN-2950-4http://www.ubuntu.com/usn/USN-2950-5https://bto.bluecoat.com/security-advisory/sa122https://security.gentoo.org/glsa/201612-47https://www.samba.org/samba/history/samba-4.2.10.htmlhttps://www.samba.org/samba/latest_news.html#4.4.2https://www.samba.org/samba/security/CVE-2016-2114.html
2016-04-25
Published