CVE-2016-2124: Medium severity Samba Samba vulnerability
A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
Other sources
As per upstream advisory:
An attacker can downgrade a negotiated SMB1 client connection and its capabitilities. Kerberos authentication is only possible with the SMB2/3 protocol or SMB1 using the NT1 dialect and the extended security (spnego) capability. Without mandatory SMB signing the protocol can be downgraded to an older insecure dialect like CORE, COREPLUS/CORE+, LANMAN1 or LANMAN2. Even if SMB signing is required it's still possible to downgrade to the NT1 dialect if extended security (spnego) is not negotiated.
The attacker is able to get the plaintext password sent over the wire even if Kerberos authentication was required.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.10.16-17.el7_9 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.14.5-7.el8_5 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.11.2-18.el8_2 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.13.3-8.el8_4 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.11.6-114.el7 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 0:4.14.5-204.el8 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.15.2 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.14.10 - Upgrade
Upgrade
redhat/sambato a version that resolves this vulnerability.Fixed in 4.13.14 - Upgrade
Upgrade
debian/sambato a version that resolves this vulnerability.Fixed in 2:4.13.13+dfsg-1~deb11u6Fixed in 2:4.17.12+dfsg-0+deb12u1Fixed in 2:4.21.1+dfsg-2 - Configuration
Set client NTLMv2 auth = yes.
Samba [global] smb.conf client NTLMv2 auth = yes - Configuration
Set client lanman auth = no.
Samba [global] smb.conf client lanman auth = no - Configuration
Set client min protocol = SMB2_02.
Samba [global] smb.conf client min protocol = SMB2_02 - Configuration
Set client plaintext auth = no.
Samba [global] smb.conf client plaintext auth = no - Operational
Use the -k command-line option without the -U option so an existing krb5 ccache is used.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-2124?
CVE-2016-2124 is classified as a medium severity vulnerability.
How do I fix CVE-2016-2124?
To fix CVE-2016-2124, upgrade Samba to the latest version that is not affected, specifically versions 4.10.16-17.el7_9, 4.14.5-7.el8_5, or later.
What systems are affected by CVE-2016-2124?
CVE-2016-2124 affects multiple versions of the Samba software across Red Hat Enterprise Linux, Debian, and Ubuntu environments.
What types of attacks can exploit CVE-2016-2124?
An attacker can exploit CVE-2016-2124 by downgrading an SMB1 client connection to retrieve plaintext passwords.
Is there a workaround for CVE-2016-2124?
Disabling SMB1 on affected systems can serve as a temporary workaround for CVE-2016-2124 until a complete upgrade is applied.