The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0612 advisory.

    ipa     [4.2.0-15.0.1.6.1]
    - Drop redhat-access-plugin-ipa requires for OL7       Blank out header-logo.png product-name.png       Replace login-screen-logo.png [20362818]

    [4.2.0-15.6.1]
    - Rebuild against newer Samba version
    - Related: #1322690

    libldb     [1.1.25-1]
    - Rebase libldb to 1.1.25
    - Related: rhbz#1322690

    libtalloc     [2.1.5-1]
    - Rebase to libtalloc 2.1.5
    - Related: rhbz#1322690

    libtdb     [1.3.8-1]
    - Rebase libtdb to 1.3.8
    - Related: rhbz#1322690

    libtevent     [0.9.26-1]
    - Rebase libtevent to 0.9.26
    - Related: rhbz#1322690

    openchange     [2.0-10]
    - Add a patch to fix connection string (Related: #1322690)

    samba     [4.2.10-6]
    - Fix domain member winbind not being able to talk to trusted domains' DCs
    - relates: #1322690

    [4.2.10-5]
    - Fix crash in smb.conf processing
    - relates: #1322690

    [4.2.10-4]
    - Fix LDAP SASL bind with arcfour-hmac-md5
    - resolves: #1322690

    [4.2.10-3]
    - Make sure the package owns /var/lib/samba and uses it for cache purposes
    - resolves: #1322690

    [4.2.10-2]
    - Remove ldb modules and internal libraries for DC when not packaging DC build
    - resolves: #1322690

    [4.2.10-1]
    - resolves: #1322690

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for samba4 and samba is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7, respectively.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a newer upstream version:
Samba (4.2.10). Refer to the Release Notes listed in the References section for a complete list of changes.

Security Fix(es) :

* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC).
(CVE-2015-5370)

Note: While Samba packages as shipped in Red Hat Enterprise Linux do not support running Samba as an AD DC, this flaw applies to all roles Samba implements.

* A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server.
As a result, the attacker would be able to get read/write access to the Security Account Manager database, and use this to reveal all passwords or any other potentially sensitive information in that database. (CVE-2016-2118)

* Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection.
(CVE-2016-2110)

* It was discovered that Samba configured as a Domain Controller would establish a secure communication channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111)

* It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections.
(CVE-2016-2112)

* It was found that Samba did not validate SSL/TLS certificates in certain connections. A man-in-the-middle attacker could use this flaw to spoof a Samba server using a specially crafted SSL/TLS certificate.
(CVE-2016-2113)

* It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a server. (CVE-2016-2114)

* It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Jouni Knuutinen (Synopsis) as the original reporter of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the original reporter of CVE-2016-2118, CVE-2016-2110, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, and CVE-2016-2115.

Security fix for CVE-2015-5370, CVE-2016-2110, CVE-2016-2111, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, CVE-2016-2115, CVE-2016-2118

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

samba was updated to fix seven security issues.

These security issues were fixed :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

These non-security issues were fixed :

  - bsc#974629: Fix samba.tests.messaging test and prevent     potential tdb corruption by removing obsolete now     invalid tdb_close call.

  - bsc#973832: Obsolete libsmbsharemodes0 from samba-libs     and libsmbsharemodes-devel from samba-core-devel.

  - bsc#972197: Obsolete libsmbclient from libsmbclient0 and     libpdb-devel from libsamba-passdb-devel while not     providing it.

  - Getting and setting Windows ACLs on symlinks can change     permissions on link

  - bsc#924519: Upgrade on-disk FSRVP server state to new     version.

  - bsc#968973: Only obsolete but do not provide gplv2/3     package names.

  - bso#6482: s3:utils/smbget: Fix recursive download.

  - bso#10489: s3: smbd: posix_acls: Fix check for setting     u:g:o entry on a filesystem with no ACL support.

  - bso#11643: docs: Add example for domain logins to     smbspool man page.

  - bso#11690: s3-client: Add a KRB5 wrapper for smbspool.

  - bso#11708: loadparm: Fix memory leak issue.

  - bso#11714: lib/tsocket: Work around sockets not     supporting FIONREAD.

  - bso#11719: ctdb-scripts: Drop use of 'smbcontrol     winbindd ip-dropped ...'.

  - bso#11727: s3:smbd:open: Skip redundant call to     file_set_dosmode when creating a new file.

  - bso#11732: param: Fix str_list_v3 to accept ';' again.

  - bso#11740: Real memeory leak(buildup) issue in loadparm.

This update was imported from the SUSE:SLE-12-SP1:Update update project.

An update for samba is now available for Red Hat Gluster Storage 3.1 for RHEL 6 and Red Hat Gluster Storage 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a newer upstream version:
Samba (4.2.10). Refer to the Release Notes listed in the References section for a complete list of changes.

Security Fix(es) :

* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC).
(CVE-2015-5370)

Note: While Samba packages as shipped in Red Hat Gluster Storage do not support running Samba as an AD DC, this flaw applies to all roles Samba implements.

* A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server.
As a result, the attacker would be able to get read/write access to the Security Account Manager database, and use this to reveal all passwords or any other potentially sensitive information in that database. (CVE-2016-2118)

* Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection.
(CVE-2016-2110)

* It was discovered that Samba configured as a Domain Controller would establish a secure communication channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111)

* It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections.
(CVE-2016-2112)

* It was found that Samba did not validate SSL/TLS certificates in certain connections. A man-in-the-middle attacker could use this flaw to spoof a Samba server using a specially crafted SSL/TLS certificate.
(CVE-2016-2113)

* It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a server. (CVE-2016-2114)

* It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Jouni Knuutinen (Synopsis) as the original reporter of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the original reporter of CVE-2016-2118, CVE-2016-2110, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, and CVE-2016-2115.

samba was updated to fix seven security issues.

These security issues were fixed :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes these security vulnerabilities :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2114: 'server signing = mandatory' not enforced     (bsc#973035).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

The openSUSE 13.1 update also upgrades to samba 4.2.4 as 4.1.x versions are no longer supported by upstream. As a side effect, libpdb0 package was replaced by libsamba-passdb0.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0620 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) or Common Internet File System     (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

    The following packages have been upgraded to a newer upstream version: Samba (4.2.10). Refer to the     Release Notes listed in the References section for a complete list of changes.

    Security Fix(es):

    * Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker     could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or,     possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could     also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an     Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller     (DC). (CVE-2015-5370)

    Note: While Samba packages as shipped in Red Hat Enterprise Linux do not support running Samba as an AD     DC, this flaw applies to all roles Samba implements.

    * A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote     Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any     authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-     middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server. As a     result, the attacker would be able to get read/write access to the Security Account Manager database, and     use this to reveal all passwords or any other potentially sensitive information in that database.
    (CVE-2016-2118)

    * Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-     in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection,     causing data to be transmitted in plain text. The attacker could also force the client or server into     sending data in plain text even if encryption was explicitly requested for that connection.
    (CVE-2016-2110)

    * It was discovered that Samba configured as a Domain Controller would establish a secure communication     channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic     could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111)

    * It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections.
    A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity     protection, allowing them to hijack such connections. (CVE-2016-2112)

    * It was found that Samba did not validate SSL/TLS certificates in certain connections. A man-in-the-     middle attacker could use this flaw to spoof a Samba server using a specially crafted SSL/TLS certificate.
    (CVE-2016-2113)

    * It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the     SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a     server. (CVE-2016-2114)

    * It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-     middle attacker could use this flaw to view and modify the data sent between a Samba server and a client.
    (CVE-2016-2115)

    Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Jouni     Knuutinen (Synopsis) as the original reporter of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the     original reporter of CVE-2016-2118, CVE-2016-2110, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, and     CVE-2016-2115.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2015-5370     Jouni Knuutinen from Synopsys discovered flaws in the     Samba DCE-RPC code which can lead to denial of service     (crashes and high cpu consumption) and man-in-the-middle     attacks.

  - CVE-2016-2110     Stefan Metzmacher of SerNet and the Samba Team     discovered that the feature negotiation of NTLMSSP does     not protect against downgrade attacks.

  - CVE-2016-2111     When Samba is configured as domain controller, it allows     remote attackers to spoof the computer name of a secure     channel's endpoint, and obtain sensitive session     information. This flaw corresponds to the same     vulnerability as CVE-2015-0005 for Windows, discovered     by Alberto Solino from Core Security.

  - CVE-2016-2112     Stefan Metzmacher of SerNet and the Samba Team     discovered that a man-in-the-middle attacker can     downgrade LDAP connections to avoid integrity     protection.

  - CVE-2016-2113     Stefan Metzmacher of SerNet and the Samba Team     discovered that man-in-the-middle attacks are possible     for client triggered LDAP connections and ncacn_http     connections.

  - CVE-2016-2114     Stefan Metzmacher of SerNet and the Samba Team     discovered that Samba does not enforce required smb     signing even if explicitly configured.

  - CVE-2016-2115     Stefan Metzmacher of SerNet and the Samba Team     discovered that SMB connections for IPC traffic are not     integrity-protected.

  - CVE-2016-2118     Stefan Metzmacher of SerNet and the Samba Team     discovered that a man-in-the-middle attacker can     intercept any DCERPC traffic between a client and a     server in order to impersonate the client and obtain the     same privileges as the authenticated user account.

New samba packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2950-1 advisory.

    Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote     attacker could use this issue to perform a denial of service, downgrade secure connections by performing a

    machine-in-the-middle attack, or possibly execute arbitrary code. (CVE-2015-5370)

    Stefan Metzmacher discovered that Samba contained multiple flaws in the NTLMSSP authentication     implementation. A remote attacker could use this issue to downgrade connections to plain text by     performing a

    machine-in-the-middle attack. (CVE-2016-2110)

    Alberto Solino discovered that a Samba domain controller would establish a secure connection to a server     with a spoofed computer name. A remote attacker could use this issue to obtain sensitive information.
    (CVE-2016-2111)

    Stefan Metzmacher discovered that the Samba LDAP implementation did not enforce integrity protection. A     remote attacker could use this issue to hijack LDAP connections by performing a machine-in-the-middle     attack. (CVE-2016-2112)

    Stefan Metzmacher discovered that Samba did not validate TLS certificates. A remote attacker could use     this issue to spoof a Samba server. (CVE-2016-2113)

    Stefan Metzmacher discovered that Samba did not enforce SMB signing even if configured to. A remote     attacker could use this issue to perform a machine-in-the-middle attack. (CVE-2016-2114)

    Stefan Metzmacher discovered that Samba did not enable integrity protection for IPC traffic. A remote     attacker could use this issue to perform a machine-in-the-middle attack. (CVE-2016-2115)

    Stefan Metzmacher discovered that Samba incorrectly handled the MS-SAMR and MS-LSAD protocols. A remote     attacker could use this flaw with a machine-in-the-middle attack to impersonate users and obtain sensitive     information from the Security Account Manager database. This flaw is known as Badlock. (CVE-2016-2118)

    Samba has been updated to 4.3.8 in Ubuntu 14.04 LTS and Ubuntu 15.10. Ubuntu 12.04 LTS has been updated to     3.6.25 with backported security fixes.

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes. Configuration changes may be required in certain environments.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-2950-1 fixed vulnerabilities in Samba. The backported fixes introduced in Ubuntu 12.04 LTS caused interoperability issues. This update fixes compatibility with certain NAS devices, and allows connecting to Samba 3.6 servers by relaxing the 'client ipc signing' parameter to 'auto'.

We apologize for the inconvenience.

Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote attacker could use this issue to perform a denial of service, downgrade secure connections by performing a man in the middle attack, or possibly execute arbitrary code. (CVE-2015-5370)

Stefan Metzmacher discovered that Samba contained multiple flaws in the NTLMSSP authentication implementation. A remote attacker could use this issue to downgrade connections to plain text by performing a man in the middle attack.
(CVE-2016-2110)

Alberto Solino discovered that a Samba domain controller would establish a secure connection to a server with a spoofed computer name. A remote attacker could use this issue to obtain sensitive information. (CVE-2016-2111)

Stefan Metzmacher discovered that the Samba LDAP implementation did not enforce integrity protection. A remote attacker could use this issue to hijack LDAP connections by performing a man in the middle attack.
(CVE-2016-2112)

Stefan Metzmacher discovered that Samba did not validate TLS certificates. A remote attacker could use this issue to spoof a Samba server. (CVE-2016-2113)

Stefan Metzmacher discovered that Samba did not enforce SMB signing even if configured to. A remote attacker could use this issue to perform a man in the middle attack.
(CVE-2016-2114)

Stefan Metzmacher discovered that Samba did not enable integrity protection for IPC traffic. A remote attacker could use this issue to perform a man in the middle attack.
(CVE-2016-2115)

Stefan Metzmacher discovered that Samba incorrectly handled the MS-SAMR and MS-LSAD protocols. A remote attacker could use this flaw with a man in the middle attack to impersonate users and obtain sensitive information from the Security Account Manager database. This flaw is known as Badlock.
(CVE-2016-2118)

Samba has been updated to 4.3.8 in Ubuntu 14.04 LTS and Ubuntu 15.10. Ubuntu 12.04 LTS has been updated to 3.6.25 with backported security fixes.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
Configuration changes may be required in certain environments.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in Samba's DCE/RPC protocol     implementation. A remote, authenticated attacker could     use these flaws to cause a denial of service against     the Samba server (high CPU load or a crash) or,     possibly, execute arbitrary code with the permissions     of the user running Samba (root). This flaw could also     be used to downgrade a secure DCE/RPC connection by a     man-in-the-middle attacker taking control of an Active     Directory (AD) object and compromising the security of     a Samba Active Directory Domain Controller     (DC).(CVE-2015-5370)

  - A protocol flaw, publicly referred to as Badlock, was     found in the Security Account Manager Remote Protocol     (MS-SAMR) and the Local Security Authority (Domain     Policy) Remote Protocol (MS-LSAD). Any authenticated     DCE/RPC connection that a client initiates against a     server could be used by a man-in-the-middle attacker to     impersonate the authenticated user against the SAMR or     LSA service on the server.

  - As a result, the attacker would be able to get     read/write access to the Security Account Manager     database, and use this to reveal all passwords or any     other potentially sensitive information in that     database. (CVE-2016-2118)

  - Several flaws were found in Samba's implementation of     NTLMSSP authentication. An nauthenticated,     man-in-the-middle attacker could use this flaw to clear     the encryption and integrity flags of a connection,     causing data to be transmitted in plain text. The     attacker could also force the client or server into     sending data in plain text even if encryption was     explicitly requested for that     connection.(CVE-2016-2110)

  - It was discovered that Samba configured as a Domain     Controller would establish a secure communication     channel with a machine using a spoofed computer name. A     remote attacker able to observe network traffic could     use this flaw to obtain session-related information     about the spoofed machine. (CVE-2016-2111)

  - It was found that Samba's LDAP implementation did not     enforce integrity protection for LDAP connections. A     man-in-the-middle attacker could use this flaw to     downgrade LDAP connections to use no integrity     protection, allowing them to hijack such     connections.(CVE-2016-2112)

  - It was found that Samba did not validate SSL/TLS     certificates in certain connections. A     man-in-the-middle attacker could use this flaw to spoof     a Samba server using a specially crafted SSL/TLS     certificate.(CVE-2016-2113)

  - It was discovered that Samba did not enforce Server     Message Block (SMB) signing for clients using the SMB1     protocol. A man-in-the-middle attacker could use this     flaw to modify traffic between a client and a server.
    (CVE-2016-2114)

  - It was found that Samba did not enable integrity     protection for IPC traffic by default. A     man-in-the-middle attacker could use this flaw to view     and modify the data sent between a Samba server and a     client.(CVE-2016-2115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
90487	Oracle Linux 6 / 7 : samba / and / samba4 (ELSA-2016-0612)	Nessus	Oracle Linux Local Security Checks	2016/4/13	2024/11/1	high
90492	RHEL 6 / 7 : samba and samba4 (RHSA-2016:0612) (Badlock)	Nessus	Red Hat Local Security Checks	2016/4/13	2019/10/24	high
90519	Fedora 23 : samba-4.3.8-0.fc23 (2016-be53260726) (Badlock)	Nessus	Fedora Local Security Checks	2016/4/14	2021/1/11	high
90522	openSUSE Security Update : samba (openSUSE-2016-453) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/14	2021/1/19	high
90530	RHEL 6 / 7 : Storage Server (RHSA-2016:0614) (Badlock)	Nessus	Red Hat Local Security Checks	2016/4/15	2019/10/24	high
90534	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2016:1024-1) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/15	2021/1/6	high
90609	openSUSE Security Update : samba (openSUSE-2016-490) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/21	2021/1/19	high
90497	RHEL 6 : samba4 (RHSA-2016:0620)	Nessus	Red Hat Local Security Checks	2016/4/13	2026/1/30	high
90515	Debian DSA-3548-1 : samba - security update (Badlock)	Nessus	Debian Local Security Checks	2016/4/14	2021/1/11	high
90533	SUSE SLES11 Security Update : samba (SUSE-SU-2016:1023-1) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/15	2021/1/19	high
90548	Slackware 14.0 / 14.1 / current : samba (SSA:2016-106-02) (Badlock)	Nessus	Slackware Local Security Checks	2016/4/18	2021/1/14	high
90588	Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2950-1)	Nessus	Ubuntu Local Security Checks	2016/4/19	2024/8/27	high
91256	Ubuntu 12.04 LTS : samba regressions (USN-2950-4) (Badlock)	Nessus	Ubuntu Local Security Checks	2016/5/19	2023/1/12	high
99777	EulerOS 2.0 SP1 : samba (EulerOS-SA-2016-1014)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/23	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high