PT-2016-3326 · Samba Team+6 · Samba+5
Alberto Solino
·
Published
2015-04-01
·
Updated
2024-06-15
·
CVE-2016-2111
CVSS v3.1
6.3
Medium
| Vector | AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Samba versions 3.x through 4.4.x before 4.4.2
Samba versions 4.3.x before 4.3.8
Samba versions 4.2.x before 4.2.11
Description
The issue is related to security flaws in the NETLOGON service of the Samba network interaction software package. It allows a remote attacker to exploit the vulnerability, potentially gaining access to confidential data and compromising its integrity. The vulnerability can be exploited by running a crafted application and leveraging the ability to sniff network traffic, which enables the attacker to spoof the computer name of a secure channel's endpoint and obtain sensitive session information.
Recommendations
For Samba versions 3.x through 4.4.x before 4.4.2, update to version 4.4.2 or later.
For Samba versions 4.3.x before 4.3.8, update to version 4.3.8 or later.
For Samba versions 4.2.x before 4.2.11, update to version 4.2.11 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Samba
Suse
Ubuntu