[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

243238

 
 

909

 
 

192833

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2016-2118Date: (C)2016-04-28   (M)2023-12-22


The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 7.5CVSS Score : 6.8
Exploit Score: 1.6Exploit Score: 8.6
Impact Score: 5.9Impact Score: 6.4
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: HIGHAccess Complexity: MEDIUM
Privileges Required: NONEAuthentication: NONE
User Interaction: REQUIREDConfidentiality: PARTIAL
Scope: UNCHANGEDIntegrity: PARTIAL
Confidentiality: HIGHAvailability: PARTIAL
Integrity: HIGH 
Availability: HIGH 
  
Reference:
SECTRACK-1035533
BID-86002
DSA-3548
FEDORA-2016-383fce04e2
FEDORA-2016-48b3761baa
FEDORA-2016-be53260726
GLSA-201612-47
RHSA-2016:0611
RHSA-2016:0612
RHSA-2016:0613
RHSA-2016:0614
RHSA-2016:0618
RHSA-2016:0619
RHSA-2016:0620
RHSA-2016:0621
RHSA-2016:0623
RHSA-2016:0624
RHSA-2016:0625
SSA:2016-106-02
SUSE-SU-2016:1022
SUSE-SU-2016:1023
SUSE-SU-2016:1024
SUSE-SU-2016:1028
USN-2950-1
USN-2950-2
USN-2950-3
USN-2950-4
USN-2950-5
VU#813296
http://badlock.org/
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
https://access.redhat.com/security/vulnerabilities/badlock
https://bto.bluecoat.com/security-advisory/sa122
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05162399
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05166182
https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes
https://kb.netapp.com/support/s/article/ka51A0000008SXzQAM/smb-vulnerabilities-in-multiple-netapp-products
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40196
https://www.samba.org/samba/history/samba-4.2.10.html
https://www.samba.org/samba/latest_news.html#4.4.2
https://www.samba.org/samba/security/CVE-2016-2118.html
openSUSE-SU-2016:1025
openSUSE-SU-2016:1064
openSUSE-SU-2016:1106
openSUSE-SU-2016:1107

CPE    6
cpe:/o:debian:debian_linux:7.0
cpe:/o:canonical:ubuntu_linux:15.10
cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~
cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~
...
CWE    1
CWE-254
OVAL    41
oval:org.secpod.oval:def:203909
oval:org.secpod.oval:def:203908
oval:org.secpod.oval:def:203907
oval:org.secpod.oval:def:110394
...

© SecPod Technologies