CVE-2016-2125: Input Validation
As per upstream:
Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to fully impersonate the authenticated user or service.
The risks of impersonation of the client are similar to the well known risks from forwarding of NTLM credentials, with two important differences: - NTLM forwarding can and should be mitigated with packet signing - Kerberos forwarding can only be attempted after the trusted destination server decrypts the ticket.
Finally, it should be noted that typically the connections involved are either explicitly requested, or are between or to Domain Controllers already of ultimate privilege.
Other sources
It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2125?
CVE-2016-2125 is classified as a moderate severity vulnerability.
How do I fix CVE-2016-2125?
To fix CVE-2016-2125, update the Samba package to versions 4.5.3, 4.4.8, or 4.3.13, depending on your current installation.
What are the affected systems by CVE-2016-2125?
CVE-2016-2125 affects multiple versions of Samba running on various Red Hat Enterprise Linux distributions.
What type of vulnerability is CVE-2016-2125?
CVE-2016-2125 is a Kerberos authentication vulnerability in the Samba client code.
Can CVE-2016-2125 allow unauthorized access?
Yes, CVE-2016-2125 can permit attackers to impersonate users due to improper handling of Kerberos tickets.