CVE-2016-2113

CVE-2016-2113 affects Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2. The issue is that Samba does not verify X.509 certificates from TLS servers, allowing a man-in-the-middle to spoof LDAPS and HTTPS servers and thereby obtain sensitive information via a crafted certificate....

CVE-2016-2110

CVE-2016-2110 affects Samba NTLMSSP in Samba 3.x/4.x (pre-4.2.11, pre-4.3.8, pre-4.4.2). The vulnerability lets an unauthenticated MITM downgrade the protocol by clearing NTLMSSP_NEGOTIATE_SEAL/NTLMSSP_NEGOTIATE_SIGN, potentially disrupting LDAP security. The related F5 advisories reiterate the s...

CVE-2016-2111

The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted applicatio...

CVE-2016-2113

Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate...

CVE-2016-2114

The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" setting, which allows man-in-the-middle attackers to spoof SMB servers by modifying the client-server data stream...

samba: multiple issues

CVE-2015-5370 arbitrary code execution Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server high CPU load or a crash or, possibly, execute arbitrary code with the...

Fedora 24 : samba-4.4.2-1.fc24 (2016-383fce04e2) (Badlock)

Security fix for CVE-2015-5370, CVE-2016-2110, CVE-2016-2111, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, CVE-2016-2115, CVE-2016-2118 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatical...

openSUSE: Security Advisory for samba (openSUSE-SU-2016:1106-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : apparmor (openSUSE-2016-491)

This update for apparmor updates some profiles. It is specifically required for the Samba security update. profile updates : - sbin.syslog-ng - usr.sbin.identd - usr.sbin.nscd allows nscd paranoia mode - usr.sbin.smbd - usr.sbin.smbldap-useradd - apache2.d/phpsysinfo updated abstractions : - aspe...

SUSE SLES10 Security Update : samba (SUSE-SU-2016:1105-1)

Samba was updated to fix three security issues. These security issues were fixed : CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication bso11688, bsc973031. CVE-2016-2111: Domain controller netlogon member computer could have been spoofed bso11749, bsc973032...

openSUSE Security Update : samba (openSUSE-2016-490) (Badlock)

This update fixes these security vulnerabilities : - CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks bsc936862. - CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication bsc973031. - CVE-2016-2111: Domain controller netlogon member computer...

Security update for samba (important)

This update fixes these security vulnerabilities: - CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks bsc936862. - CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication bsc973031. - CVE-2016-2111: Domain controller netlogon member computer...

Security update for samba (important)

This update fixes these security vulnerabilities: - CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks bsc936862. - CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication bsc973031. - CVE-2016-2111: Domain controller netlogon member computer...

Ubuntu: Security Advisory (USN-2950-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2950-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2950-1 advisory. Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote attacker could use this issue to perform a denial ...

The vulnerability of the Samba file system allows a perpetrator to circumvent existing access restrictions.

The vulnerability of the samldbcheckuseraccountcontrolacl function in the Samba file system located in the samdb/ldbmodules/samldb.c file is related to improper privilege checking during the creation of computer accounts. Exploiting this vulnerability can allow a malicious actor to circumvent...

USN-2950-1 samba vulnerabilities

Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote attacker could use this issue to perform a denial of service, downgrade secure connections by performing a machine-in-the-middle attack, or possibly execute arbitrary code. CVE-2015-5370 Stefan...

USN-2950-1: Samba vulnerabilities

Jouni Knuutinen discovered that Samba contained multiple flaws in the DCE/RPC implementation. A remote attacker could use this issue to perform a denial of service, downgrade secure connections by performing a machine-in-the-middle attack, or possibly execute arbitrary code. CVE-2015-5370 Stefan...

Pass to kill the Windows of Badlock? The How to repair? - Vulnerability warning-the black bar safety net

Badlock Bug Badlock Bug description 2 0 1 6 years 4 on 1 on 2, Windows and Samba revealed a very critical security vulnerabilities. Samba 4.4.2, and 4.3.8 and 4.2.11 security updates are available. Please update your system. We are very determined hackers will soon use this vulnerability to attac...

Slackware 14.0 / 14.1 / current : samba (SSA:2016-106-02) (Badlock)

New samba packages are available for Slackware 14.0, 14.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-106-02. The text itself is copyright C...