CVE-2016-2118: High severity samba vulnerability
The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2118?
CVE-2016-2118 is considered a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2016-2118?
To fix CVE-2016-2118, upgrade Samba to version 4.2.11, 4.3.8, or 4.4.2 or later.
What systems are affected by CVE-2016-2118?
CVE-2016-2118 affects Samba versions prior to 4.2.11, 4.3.8, and 4.4.2, as well as various Ubuntu and Debian Linux distributions.
What happens if I don't patch CVE-2016-2118?
If CVE-2016-2118 is not patched, an attacker could exploit the vulnerability to impersonate users and gain unauthorized access.
Is there a workaround for CVE-2016-2118?
No official workaround exists for CVE-2016-2118; the only solution is to apply the necessary security updates.