Security Bulletin: Multiple vulnerabilities in Samba –including Badlock - affect IBM OS Images for Red Hat Linux Systems.

Summary

Samba vulnerabilities were disclosed on April 12, 2016. Samba is used by IBM OS Images for Red Hat Linux Systems. IBM OS Images for Red Hat Linux Systems has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2016-2118 DESCRIPTION: Samba could allow a remote attacker to gain elevated privileges on the system, caused by the acceptance of inadequate authentication levels by the Microsoft Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote protocols. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate an authenticated user against the SAMR or LSAD service and gain access to the Security Account Manager (SAM) database. This vulnerability is also known as the BADLOCK bug.
CVSS Base Score: 7.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111935 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID: CVE-2015-5370 DESCRIPTION: Samba is vulnerable to a denial of service, caused by the improper validation of DCE-RPC packets by the DCE-RPC client and server implementations. An attacker could exploit this vulnerability using man-in-the-middle techniques to downgrade a secure connection to an insecure one and consume an overly large amount of CPU resources.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111936 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)

CVEID: CVE-2016-2110 DESCRIPTION: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to protect the feature negotiation of NTLMSSP from a downgrade. A remote attacker could exploit this vulnerability using man-in-the-middle techniques to clear NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL flags and perform downgrade attacks.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111937 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2111 DESCRIPTION: Samba could allow a remote attacker to conduct spoofing attacks, caused by an error in the NETLOGON service when a Domain Controller is configured. By logging into a domain joined system and observing network traffic, an attacker could exploit this vulnerability using a specially crafted application to connect to another domain joined system and access session-related information of the spoofed computer.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111938 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2112 DESCRIPTION: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to enforce integrity protection by the LDAP client and server. A remote attacker could exploit this vulnerability using man-in-the-middle techniques to downgrade LDAP connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111939 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2113 DESCRIPTION: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to validate TLS certificates. A remote attacker could exploit this vulnerability using man-in-the-middle techniques to perform unauthorized actions.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111940 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2114 DESCRIPTION: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to enforce required smb signing. A remote attacker could exploit this vulnerability using man-in-the-middle techniques to perform unauthorized actions.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111941 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2115 DESCRIPTION: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to protect the integrity of SMB client connections for IPC traffic. A remote attacker could exploit this vulnerability using man-in-the-middle techniques to perform unauthorized actions.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111942 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM OS Image for Red Hat Linux Systems 2.2.0.0 and earlier.

Remediation/Fixes

Virtual machines deployed from IBM PureApplication Systems are affected. This includes RedHat Linux deployments. The solution is to apply the following IBM PureApplication System fix to the deployed virtual machines.

Java Update for Linux
http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=PureSystems&product=ibm/WebSphere/PureApplication+System&release=All&platform=Linux&function=fixId&fixids=samba_efix_Apr_2016&includeSupersedes=0

1. Import the fix into the Emergency Fix catalogue.
2. For deployed instances, apply this emergency fix on the VM.
3. Restart the deployed instance after the fix is applied.

Workarounds and Mitigations

None