8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
0.019 Low
EPSS
Percentile
88.7%
A flaw was found in samba. The Netlogon RPC implementations may use the rc4-hmac encryption algorithm, which is considered weak and should be avoided even if the client supports more modern encryption types. This issue could allow an attacker who knows the plain text content communicated between the samba client and server to craft data with the same MD5 calculation and replace it without being detected.
Users can disable MD5-based NetLogon by adding the following snippet to their smb.conf
reject md5 clients = yes
in case there's still need to allow SMB to authenticate to MD5-based NetLogon servers, it's possible to explicitly
enable it per-server based:
server reject md5 schannel:<SERVERNAME>$ = no