CVE-2017-12150: High severity Samba Samba vulnerability
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
Other sources
There are several code paths where the code doesn't enforce SMB signing:
The fixes for CVE-2015-5296 didn't apply the implied signing protection when enforcing encryption for commands like 'smb2mount -e', 'smbcacls -e' and 'smbcquotas -e'.
The python binding exported as 'samba.samba3.libsmbsambainternal' doesn't make use of the "client signing" smb.conf option.
libgpo as well as 'net ads gpo' doesn't require SMB signing when fetching group policies.
Commandline tools like 'smbclient', 'smbcacls' and 'smbcquotas' allow a fallback to an anonymous connection when using the '--use-ccache' option and this happens even if SMB signing is required.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12150?
CVE-2017-12150 is classified as a medium severity vulnerability.
How do I fix CVE-2017-12150?
To fix CVE-2017-12150, upgrade Samba to versions 4.4.16, 4.5.14, 4.6.8 or later.
What types of attacks can CVE-2017-12150 facilitate?
CVE-2017-12150 allows a remote attacker to perform a man-in-the-middle attack.
Which versions of Samba are affected by CVE-2017-12150?
CVE-2017-12150 affects Samba versions prior to 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8.
What does the lack of SMB signing in CVE-2017-12150 allow?
The lack of SMB signing in CVE-2017-12150 allows attackers to retrieve information in plain-text.