CVE-2016-2125: Input Validation
First published: Fri Dec 09 2016(Updated: )
As per upstream: Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to fully impersonate the authenticated user or service. The risks of impersonation of the client are similar to the well known risks from forwarding of NTLM credentials, with two important differences: - NTLM forwarding can and should be mitigated with packet signing - Kerberos forwarding can only be attempted after the trusted destination server decrypts the ticket. Finally, it should be noted that typically the connections involved are either explicitly requested, or are between or to Domain Controllers already of ultimate privilege.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/samba | <4.5.3 | 4.5.3 |
| redhat/samba | <4.4.8 | 4.4.8 |
| redhat/samba | <4.3.13 | 4.3.13 |
| Samba | >=3.0.25<4.3.13 | |
| Samba | >=4.4.0<4.4.8 | |
| Samba | >=4.5.0<4.5.3 | |
| Oracle GlusterFS | =3.0 | |
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.4 | |
| Red Hat Enterprise Linux Server | =7.5 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.3 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rhn.redhat.com/errata/RHSA-2017-0494.html
- http://rhn.redhat.com/errata/RHSA-2017-0495.html
- http://rhn.redhat.com/errata/RHSA-2017-0662.html
- http://rhn.redhat.com/errata/RHSA-2017-0744.html
- http://www.securityfocus.com/bid/94988
- http://www.securitytracker.com/id/1037494
- https://access.redhat.com/errata/RHSA-2017:1265
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2125
- https://www.samba.org/samba/security/CVE-2016-2125.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1405984
- https://rhn.redhat.com/errata/RHSA-2017-0662.html
- https://rhn.redhat.com/errata/RHSA-2017-0744.html
- https://rhn.redhat.com/errata/RHSA-2017-0494.html
- https://rhn.redhat.com/errata/RHSA-2017-0495.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1403114
Frequently Asked Questions
What is the severity of CVE-2016-2125?
CVE-2016-2125 is classified as a moderate severity vulnerability.
How do I fix CVE-2016-2125?
To fix CVE-2016-2125, update the Samba package to versions 4.5.3, 4.4.8, or 4.3.13, depending on your current installation.
What are the affected systems by CVE-2016-2125?
CVE-2016-2125 affects multiple versions of Samba running on various Red Hat Enterprise Linux distributions.
What type of vulnerability is CVE-2016-2125?
CVE-2016-2125 is a Kerberos authentication vulnerability in the Samba client code.
Can CVE-2016-2125 allow unauthorized access?
Yes, CVE-2016-2125 can permit attackers to impersonate users due to improper handling of Kerberos tickets.
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-2125
- agent/software-canonical-lookup
- agent/remedy
- agent/weakness
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/samba
- canonical/samba
- version/samba/3.0.25
- version/samba/4.4.0
- version/samba/4.5.0
- vendor/redhat
- canonical/oracle glusterfs
- version/oracle glusterfs/3.0
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.4
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/7.3
- version/red hat enterprise linux server/7.5
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0