Published: 07/07/2016 Updated: 29/08/2022

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.5 | Impact Score: 5.9 | Exploitability Score: 1.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

libcli/smb/smbXcli_base.c in Samba 4.x prior to 4.2.14, 4.3.x prior to 4.3.11, and 4.4.x prior to 4.4.5 allows man-in-the-middle malicious users to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag.

Vulnerable Product	Search on Vulmon	Subscribe to Product
samba samba

Debian Bug report logs - #830195 samba: CVE-2016-2119: Client side SMB2/3 required signing can be downgraded Package: src:samba; Maintainer for src:samba is Debian Samba Maintainers <pkg-samba-maint@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 7 Jul 2016 09:39:07 UTC Sev ...

Samba could be tricked into connecting to impersonated servers ...

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2016-2119 Stefan Metzmacher discovered that client-side SMB2/3 required signing can be downgraded, allowing a man-in-the-middle attacker to imper ...

A flaw was found in the way Samba initiated signed DCE/RPC connections A man-in-the-middle attacker could use this flaw to downgrade the connection to not use signing and therefore impersonate the server ...

CWE-94 https://www.samba.org/samba/security/CVE-2016-2119.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html http://rhn.redhat.com/errata/RHSA-2016-1487.html http://rhn.redhat.com/errata/RHSA-2016-1486.html http://rhn.redhat.com/errata/RHSA-2016-1494.html http://lists.opensuse.org/opensuse-updates/2016-07/msg00060.html http://www.securityfocus.com/bid/91700 http://www.securitytracker.com/id/1036244 https://security.gentoo.org/glsa/201805-07 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=830195 https://usn.ubuntu.com/3092-1/https://nvd.nist.gov

CVE-2016-2119

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect