CVE-2016-2124

MEDIUM

5.9

Description

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

CVE Details

CVSS v3.1 Score5.9

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredNONE

User InteractionNONE

Published2/18/2022

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

canonical:ubuntu_linuxdebian:debian_linuxfedoraproject:fedoraredhat:codeready_linux_builderredhat:enterprise_linuxredhat:enterprise_linux_desktopredhat:enterprise_linux_eusredhat:enterprise_linux_for_ibm_z_systemsredhat:enterprise_linux_for_ibm_z_systems_eusredhat:enterprise_linux_for_power_big_endianredhat:enterprise_linux_for_power_little_endianredhat:enterprise_linux_for_power_little_endian_eusredhat:enterprise_linux_for_scientific_computingredhat:enterprise_linux_resilient_storageredhat:enterprise_linux_serverredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_tusredhat:enterprise_linux_server_update_services_for_sap_solutionsredhat:enterprise_linux_tusredhat:enterprise_linux_workstationredhat:gluster_storageredhat:openstackredhat:virtualization_hostsamba:samba

Weaknesses (CWE)

CWE-287CWE-287

References

https://bugzilla.redhat.com/show_bug.cgi?id=2019660(secalert@redhat.com)

https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html(secalert@redhat.com)

https://security.gentoo.org/glsa/202309-06(secalert@redhat.com)

https://www.samba.org/samba/security/CVE-2016-2124.html(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2019660(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202309-06(af854a3a-2127-422b-91ae-364da2661108)

https://www.samba.org/samba/security/CVE-2016-2124.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.