CVE-2016-2124: Medium severity samba vulnerability
A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
Other sources
As per upstream advisory:
An attacker can downgrade a negotiated SMB1 client connection and its capabitilities. Kerberos authentication is only possible with the SMB2/3 protocol or SMB1 using the NT1 dialect and the extended security (spnego) capability. Without mandatory SMB signing the protocol can be downgraded to an older insecure dialect like CORE, COREPLUS/CORE+, LANMAN1 or LANMAN2. Even if SMB signing is required it's still possible to downgrade to the NT1 dialect if extended security (spnego) is not negotiated.
The attacker is able to get the plaintext password sent over the wire even if Kerberos authentication was required.
— Red Hat
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-2124?
CVE-2016-2124 is classified as a medium severity vulnerability.
How do I fix CVE-2016-2124?
To fix CVE-2016-2124, upgrade Samba to the latest version that is not affected, specifically versions 4.10.16-17.el7_9, 4.14.5-7.el8_5, or later.
What systems are affected by CVE-2016-2124?
CVE-2016-2124 affects multiple versions of the Samba software across Red Hat Enterprise Linux, Debian, and Ubuntu environments.
What types of attacks can exploit CVE-2016-2124?
An attacker can exploit CVE-2016-2124 by downgrading an SMB1 client connection to retrieve plaintext passwords.
Is there a workaround for CVE-2016-2124?
Disabling SMB1 on affected systems can serve as a temporary workaround for CVE-2016-2124 until a complete upgrade is applied.