A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2019660 | Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html | |
| https://security.gentoo.org/glsa/202309-06 | |
| https://www.samba.org/samba/security/CVE-2016-2124.html | Mitigation Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2019660 | Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html | |
| https://security.gentoo.org/glsa/202309-06 | |
| https://www.samba.org/samba/security/CVE-2016-2124.html | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
21 Nov 2024, 02:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2019660 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html - | |
| References | () https://security.gentoo.org/glsa/202309-06 - | |
| References | () https://www.samba.org/samba/security/CVE-2016-2124.html - Mitigation, Vendor Advisory |
25 Feb 2022, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-287 | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 5.9 |
| References | (MISC) https://www.samba.org/samba/security/CVE-2016-2124.html - Mitigation, Vendor Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2019660 - Issue Tracking, Patch, Third Party Advisory | |
| CPE | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:gluster_storage:3.5:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:16.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_resilient_storage:7.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
18 Feb 2022, 18:33
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-18 18:15
Updated : 2024-11-21 02:47
NVD link : CVE-2016-2124
Mitre link : CVE-2016-2124
CVE.ORG link : CVE-2016-2124
JSON object : View
Products Affected
redhat
- codeready_linux_builder
- enterprise_linux
- enterprise_linux_for_scientific_computing
- enterprise_linux_server_tus
- enterprise_linux_eus
- virtualization_host
- enterprise_linux_workstation
- enterprise_linux_desktop
- enterprise_linux_for_power_big_endian
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_server_aus
- enterprise_linux_for_power_little_endian
- enterprise_linux_resilient_storage
- enterprise_linux_server_update_services_for_sap_solutions
- enterprise_linux_tus
- enterprise_linux_server
- gluster_storage
- openstack
canonical
- ubuntu_linux
fedoraproject
- fedora
samba
- samba
debian
- debian_linux
CWE
CWE-287
Improper Authentication