CVE-2016-2112

samba: Missing downgrade detection

Published Apr 25, 2016 CVSS 3.0 · 5.9 Medium EPSS 9.4% KEV · Not listed
Description
The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-3548-1 samba security update
Ubuntu USN Ubuntu USN USN-2950-1 Samba vulnerabilities
References
Link Providers
http://badlock.org/ cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html cve-icon cve-icon
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-0611.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-0612.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-0613.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-0614.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-0618.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-0619.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-0620.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2016-0624.html cve-icon cve-icon
http://www.debian.org/security/2016/dsa-3548 cve-icon cve-icon
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html cve-icon cve-icon
http://www.securitytracker.com/id/1035533 cve-icon cve-icon
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2950-1 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2950-2 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2950-3 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2950-4 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2950-5 cve-icon cve-icon
https://access.redhat.com/articles/2243351 cve-icon
https://bto.bluecoat.com/security-advisory/sa122 cve-icon cve-icon
https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05087821 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05082964 cve-icon cve-icon
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05162399 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2016-2112 cve-icon
https://security.gentoo.org/glsa/201612-47 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2016-2112 cve-icon
https://www.samba.org/samba/history/samba-4.2.10.html cve-icon cve-icon
https://www.samba.org/samba/latest_news.html#4.4.2 cve-icon cve-icon
https://www.samba.org/samba/security/CVE-2016-2112.html cve-icon cve-icon
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 11:17 PM
Reserved
Jan 29, 2016, 12:00 AM
Status
Modified
Published
Apr 25, 2016, 12:59 AM
Modified
Jun 17, 2026, 12:43 AM
Severity
Moderate
Public date
Apr 12, 2016, 12:00 AM