PT-2016-2316 · Samba+5 · Samba+5

Stefan Metzmacher · Published 2016-07-07 · Updated 2024-06-15 · CVE-2016-2119

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Samba versions 4.2.14 and earlier, 4.3.11 and earlier, 4.4.5 and earlier Samba versions prior to 4.2.14 Samba versions prior to 4.3.11 Samba versions prior to 4.4.5

Description The issue allows man-in-the-middle attackers to bypass a client-signing protection mechanism and consequently spoof SMB2 and SMB3 servers via the SMB2 SESSION FLAG IS GUEST or SMB2 SESSION FLAG IS NULL flag. This is related to a function in libcli/smb/smbXcli base.c that is associated with inadequate access control. The exploitation of this issue may enable a remote attacker to substitute SMB2 and SMB3 server protocols using the SMB2 SESSION FLAG IS GUEST or SMB2 SESSION FLAG IS NULL flags.

Recommendations For Samba versions prior to 4.2.14, update to version 4.2.14 or later. For Samba versions prior to 4.3.11, update to version 4.3.11 or later. For Samba versions prior to 4.4.5, update to version 4.4.5 or later. As a temporary workaround, consider restricting access to the libcli/smb/smbXcli base.c function until a patch is available. Avoid using the SMB2 SESSION FLAG IS GUEST or SMB2 SESSION FLAG IS NULL flags in the affected API endpoints until the issue is resolved.

Fix

Code Injection

Improper Access Control

Weakness Enumeration

CWE-94

CWE-284

Related Identifiers

ALT-PU-2016-1732

ALT-PU-2016-1744

BDU:2016-01705

CESA-2016_1486

CESA-2016_1487

CVE-2016-2119

DSA-3740-1

ECHO-50EA-9C50-68B5

OPENSUSE-SU-2024:10069-1

RHSA-2016:1486

RHSA-2016:1487

RHSA-2016:1494

RHSA-2016_1486

RHSA-2016_1487

SUSE-SU-2016:2306-1

SUSE-SU-2016:2570-1

SUSE-SU-2016_2306-1

SUSE-SU-2016_2570-1

USN-3092-1

Affected Products

Alt Linux

Centos

Red Hat

Samba

Suse

Ubuntu

References · 90

• https://ubuntu.com/security/CVE-2016-2119 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3092-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10069-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-1494.html · Vendor Advisory
• https://samba.org/samba/security/CVE-2016-2119.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2119 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2306-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2016-1486.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2119 · Security Note
• https://bdu.fstec.ru/vul/2016-01705 · Security Note
• https://ubuntu.com/security/notices/USN-3092-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2119 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2016-1487.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-07/msg00060.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2119 · Security Note