A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2019660 | Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html | |
| https://security.gentoo.org/glsa/202309-06 | |
| https://www.samba.org/samba/security/CVE-2016-2124.html | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
17 Sep 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Feb 2022, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 5.9 |
| CPE | cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_resilient_storage:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:* cpe:2.3:a:redhat:gluster_storage:3.5:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:16.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* |
|
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2019660 - Issue Tracking, Patch, Third Party Advisory | |
| References | (MISC) https://www.samba.org/samba/security/CVE-2016-2124.html - Mitigation, Vendor Advisory | |
| CWE | CWE-287 | |
| First Time |
Redhat codeready Linux Builder
Redhat enterprise Linux For Power Little Endian Debian debian Linux Redhat enterprise Linux Desktop Redhat enterprise Linux Server Redhat enterprise Linux Eus Redhat enterprise Linux Server Tus Redhat enterprise Linux Resilient Storage Canonical ubuntu Linux Redhat enterprise Linux Server Aus Fedoraproject fedora Redhat enterprise Linux For Power Little Endian Eus Canonical Redhat enterprise Linux For Ibm Z Systems Redhat openstack Redhat gluster Storage Redhat enterprise Linux For Scientific Computing Redhat enterprise Linux For Power Big Endian Redhat enterprise Linux Server Update Services For Sap Solutions Fedoraproject Samba Debian Redhat enterprise Linux Workstation Samba samba Redhat enterprise Linux Redhat enterprise Linux Tus Redhat enterprise Linux For Ibm Z Systems Eus Redhat virtualization Host Redhat |
18 Feb 2022, 18:33
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-18 18:15
Updated : 2023-12-10 14:22
NVD link : CVE-2016-2124
Mitre link : CVE-2016-2124
CVE.ORG link : CVE-2016-2124
JSON object : View
Products Affected
redhat
- enterprise_linux_for_scientific_computing
- enterprise_linux_desktop
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_server
- codeready_linux_builder
- enterprise_linux_for_power_big_endian
- virtualization_host
- enterprise_linux_server_update_services_for_sap_solutions
- enterprise_linux_eus
- enterprise_linux
- enterprise_linux_server_tus
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_server_aus
- enterprise_linux_workstation
- enterprise_linux_tus
- openstack
- enterprise_linux_for_power_little_endian
- gluster_storage
- enterprise_linux_resilient_storage
canonical
- ubuntu_linux
fedoraproject
- fedora
debian
- debian_linux
samba
- samba
CWE
CWE-287
Improper Authentication