CVE-2016-2114Channel Accessible by Non-Endpoint in Samba

Severity
5.9MEDIUMNVD
EPSS
9.1%
top 7.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 25
Latest updateMay 17

Description

The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages4 packages

debiandebian/samba< samba 2:4.3.7+dfsg-1 (bookworm)
Debiansamba/samba< 2:4.3.7+dfsg-1+3
Ubuntusamba/samba< 2:4.3.9+dfsg-0ubuntu0.14.04.1+4
NVDsamba/samba69 versions+68

Also affects: Ubuntu Linux 14.04, 15.10, 16.04

Patches

🔴Vulnerability Details

6
GHSA
GHSA-qg5v-7xq3-qwf4: The SMB1 protocol implementation in Samba 42022-05-17
OSV
samba regression2016-05-25
OSV
samba regressions2016-05-04
OSV
libsoup2.4 update2016-05-04
OSV
CVE-2016-2114: The SMB1 protocol implementation in Samba 42016-04-25

📋Vendor Advisories

7
Ubuntu
Samba regression2016-05-25
Ubuntu
Samba regressions2016-05-18
Ubuntu
libsoup update2016-05-04
Ubuntu
Samba regressions2016-05-04
Ubuntu
Samba vulnerabilities2016-04-18

💬Community

2
Bugzilla
CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 samba: various flaws [fedora-all]2016-04-12
Bugzilla
CVE-2016-2114 samba: Samba based active directory domain controller does not enforce smb signing2016-02-25