CVE-2017-12151: High severity Samba Samba vulnerability
A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.
Other sources
Client command line tools like 'smbclient' as well as applications using 'libsmbclient' library have support for required encryption. This is activated by the '-e|--encrypt' command line option or the smbcsetOptionSmbEncryptionLevel() library call.
By default, only SMB1 is used in order to do connections to a server, as the effective default for "client max protocol" smb.conf option as well for the "-m|--max-protocol=" command line option is "NT1".
If the original client connection used encryption, following DFS redirects to another server also enforce encryption. This is important as these redirects are transparent to the application.
In case "SMB3", "SMB300", "SMB302", "SMB310" or "SMB311" is used as max protocol and a connection actually made use of the SMB3 encryption, any redirected connection looses the requirement for encryption and maybe also the requirement for signing. That means, a man in the middle can read and/or alter the content of the connection.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12151?
CVE-2017-12151 has a medium severity rating due to its potential to allow attackers to read or alter connection data.
How do I fix CVE-2017-12151?
To fix CVE-2017-12151, update Samba to version 4.4.16, 4.5.14, 4.6.8 or later.
What versions of Samba are affected by CVE-2017-12151?
Samba versions before 4.4.16, 4.5.14, and 4.6.8 are affected by CVE-2017-12151.
What platforms are vulnerable to CVE-2017-12151?
Debian and Red Hat Enterprise Linux versions running affected Samba iterations are vulnerable to CVE-2017-12151.
Is CVE-2017-12151 exploitable remotely?
Yes, CVE-2017-12151 can be exploited remotely, allowing attackers to manipulate the connection.