CVE-2016-2124 - log back

CVE-2016-2124 edited at 09 Nov 2021 20:45:40
References
https://www.samba.org/samba/security/CVE-2016-2124.html
https://www.samba.org/samba/ftp/patches/security/samba-4.15.1-security-2021-11-09.patch
- https://www.samba.org/samba/security/CVE-2020-25717.html
CVE-2016-2124 edited at 09 Nov 2021 20:45:22
References
https://www.samba.org/samba/security/CVE-2016-2124.html
https://www.samba.org/samba/ftp/patches/security/samba-4.15.1-security-2021-11-09.patch
+ https://www.samba.org/samba/security/CVE-2020-25717.html
CVE-2016-2124 edited at 09 Nov 2021 20:42:43
Description
- A security issue has been found in Samba versions 3.0.0 to 4.15.1. A man in the middle attack can force the client side SMB1 code to fall-back to plaintext or NTLM based authentication even if Kerberos authentication was requested by the user or application.
+ A security issue has been found in Samba versions 3.0.0 to 4.15.1. A man in the middle attack can force the client side SMB1 code to fall-back to plaintext or NTLM based authentication even if Kerberos authentication was requested by the user or application.
CVE-2016-2124 edited at 09 Nov 2021 20:41:20
Severity
- Unknown
+ Medium
Remote
- Unknown
+ Remote
Type
- Unknown
+ Silent downgrade
Description
+ A security issue has been found in Samba versions 3.0.0 to 4.15.1. A man in the middle attack can force the client side SMB1 code to fall-back to plaintext or NTLM based authentication even if Kerberos authentication was requested by the user or application.
References
+ https://www.samba.org/samba/security/CVE-2016-2124.html
+ https://www.samba.org/samba/ftp/patches/security/samba-4.15.1-security-2021-11-09.patch
Notes
+ Workaround
+ ==========
+
+ To mitigate the issue, ensure the following [global] smb.conf parameters are set to their default values as shown below:
+
+ client lanman auth = no
+ client NTLMv2 auth = yes
+ client plaintext auth = no
+ client min protocol = SMB2_02
+
+ Or use the '-k' command line option only without the -U option, which will make use of an existing krb5 ccache.
CVE-2016-2124 created at 09 Nov 2021 20:36:10