Lucene search

[email protected]CVE-2016-2110

HistoryApr 25, 2016 - 12:59 a.m.

CVE-2016-2110

2016-04-2500:59:01

CWE-254

[email protected]

web.nvd.nist.gov

ntlmssp

samba

protocol-downgrade

man-in-the-middle

authentication

cve-2016-2110

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

6.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.0%

JSON

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.

Affected configurations

NVD

Node

sambasambaMatch3.0.0

sambasambaMatch3.0.1

sambasambaMatch3.0.2

sambasambaMatch3.0.2a

sambasambaMatch3.0.3

sambasambaMatch3.0.4

sambasambaMatch3.0.4rc1

sambasambaMatch3.0.5

sambasambaMatch3.0.6

sambasambaMatch3.0.7

sambasambaMatch3.0.8

sambasambaMatch3.0.9

sambasambaMatch3.0.10

sambasambaMatch3.0.11

sambasambaMatch3.0.12

sambasambaMatch3.0.13

sambasambaMatch3.0.14

sambasambaMatch3.0.14a

sambasambaMatch3.0.15

sambasambaMatch3.0.16

sambasambaMatch3.0.17

sambasambaMatch3.0.18

sambasambaMatch3.0.19

sambasambaMatch3.0.20

sambasambaMatch3.0.20a

sambasambaMatch3.0.20b

sambasambaMatch3.0.20a

sambasambaMatch3.0.20b

sambasambaMatch3.0.21

sambasambaMatch3.0.21a

sambasambaMatch3.0.21b

sambasambaMatch3.0.21c

sambasambaMatch3.0.21a

sambasambaMatch3.0.21b

sambasambaMatch3.0.21c

sambasambaMatch3.0.22

sambasambaMatch3.0.23

sambasambaMatch3.0.23a

sambasambaMatch3.0.23b

sambasambaMatch3.0.23c

sambasambaMatch3.0.23d

sambasambaMatch3.0.23a

sambasambaMatch3.0.23b

sambasambaMatch3.0.23c

sambasambaMatch3.0.23d

sambasambaMatch3.0.24

sambasambaMatch3.0.25

sambasambaMatch3.0.25a

sambasambaMatch3.0.25b

sambasambaMatch3.0.25c

sambasambaMatch3.0.25pre1

sambasambaMatch3.0.25pre2

sambasambaMatch3.0.25rc1

sambasambaMatch3.0.25rc2

sambasambaMatch3.0.25rc3

sambasambaMatch3.0.25a

sambasambaMatch3.0.25b

sambasambaMatch3.0.25c

sambasambaMatch3.0.26

sambasambaMatch3.0.26a

sambasambaMatch3.0.27

sambasambaMatch3.0.27a

sambasambaMatch3.0.28

sambasambaMatch3.0.28a

sambasambaMatch3.0.29

sambasambaMatch3.0.30

sambasambaMatch3.0.31

sambasambaMatch3.0.32

sambasambaMatch3.0.33

sambasambaMatch3.0.34

sambasambaMatch3.0.35

sambasambaMatch3.0.36

sambasambaMatch3.0.37

sambasambaMatch3.2.0

sambasambaMatch3.2.1

sambasambaMatch3.2.2

sambasambaMatch3.2.3

sambasambaMatch3.2.4

sambasambaMatch3.2.5

sambasambaMatch3.2.6

sambasambaMatch3.2.7

sambasambaMatch3.2.8

sambasambaMatch3.2.9

sambasambaMatch3.2.10

sambasambaMatch3.2.11

sambasambaMatch3.2.12

sambasambaMatch3.2.13

sambasambaMatch3.2.14

sambasambaMatch3.2.15

sambasambaMatch3.3.0

sambasambaMatch3.3.1

sambasambaMatch3.3.2

sambasambaMatch3.3.3

sambasambaMatch3.3.4

sambasambaMatch3.3.5

sambasambaMatch3.3.6

sambasambaMatch3.3.7

sambasambaMatch3.3.8

sambasambaMatch3.3.9

sambasambaMatch3.3.10

sambasambaMatch3.3.11

sambasambaMatch3.3.12

sambasambaMatch3.3.13

sambasambaMatch3.3.14

sambasambaMatch3.3.15

sambasambaMatch3.3.16

sambasambaMatch3.4.0

sambasambaMatch3.4.1

sambasambaMatch3.4.2

sambasambaMatch3.4.3

sambasambaMatch3.4.4

sambasambaMatch3.4.5

sambasambaMatch3.4.6

sambasambaMatch3.4.7

sambasambaMatch3.4.8

sambasambaMatch3.4.9

sambasambaMatch3.4.10

sambasambaMatch3.4.11

sambasambaMatch3.4.12

sambasambaMatch3.4.13

sambasambaMatch3.4.14

sambasambaMatch3.4.15

sambasambaMatch3.4.16

sambasambaMatch3.4.17

sambasambaMatch3.5.0

sambasambaMatch3.5.1

sambasambaMatch3.5.2

sambasambaMatch3.5.3

sambasambaMatch3.5.4

sambasambaMatch3.5.5

sambasambaMatch3.5.6

sambasambaMatch3.5.7

sambasambaMatch3.5.8

sambasambaMatch3.5.9

sambasambaMatch3.5.10

sambasambaMatch3.5.11

sambasambaMatch3.5.12

sambasambaMatch3.5.13

sambasambaMatch3.5.14

sambasambaMatch3.5.15

sambasambaMatch3.5.16

sambasambaMatch3.5.17

sambasambaMatch3.5.18

sambasambaMatch3.5.19

sambasambaMatch3.5.20

sambasambaMatch3.5.21

sambasambaMatch3.5.22

sambasambaMatch3.6.0

sambasambaMatch3.6.1

sambasambaMatch3.6.2

sambasambaMatch3.6.3

sambasambaMatch3.6.4

sambasambaMatch3.6.5

sambasambaMatch3.6.6

sambasambaMatch3.6.7

sambasambaMatch3.6.8

sambasambaMatch3.6.9

sambasambaMatch3.6.10

sambasambaMatch3.6.11

sambasambaMatch3.6.12

sambasambaMatch3.6.13

sambasambaMatch3.6.14

sambasambaMatch3.6.15

sambasambaMatch3.6.16

sambasambaMatch3.6.17

sambasambaMatch3.6.18

sambasambaMatch3.6.19

sambasambaMatch3.6.20

sambasambaMatch3.6.21

sambasambaMatch3.6.22

sambasambaMatch3.6.23

sambasambaMatch3.6.24

sambasambaMatch3.6.25

sambasambaMatch4.0.0

sambasambaMatch4.0.1

sambasambaMatch4.0.2

sambasambaMatch4.0.3

sambasambaMatch4.0.4

sambasambaMatch4.0.5

sambasambaMatch4.0.6

sambasambaMatch4.0.7

sambasambaMatch4.0.8

sambasambaMatch4.0.9

sambasambaMatch4.0.10

sambasambaMatch4.0.11

sambasambaMatch4.0.12

sambasambaMatch4.0.13

sambasambaMatch4.0.14

sambasambaMatch4.0.15

sambasambaMatch4.0.16

sambasambaMatch4.0.17

sambasambaMatch4.0.18

sambasambaMatch4.0.19

sambasambaMatch4.0.20

sambasambaMatch4.0.21

sambasambaMatch4.0.22

sambasambaMatch4.0.23

sambasambaMatch4.0.24

sambasambaMatch4.0.25

sambasambaMatch4.0.26

sambasambaMatch4.1.0

sambasambaMatch4.1.1

sambasambaMatch4.1.2

sambasambaMatch4.1.3

sambasambaMatch4.1.4

sambasambaMatch4.1.5

sambasambaMatch4.1.6

sambasambaMatch4.1.7

sambasambaMatch4.1.8

sambasambaMatch4.1.9

sambasambaMatch4.1.10

sambasambaMatch4.1.11

sambasambaMatch4.1.12

sambasambaMatch4.1.13

sambasambaMatch4.1.14

sambasambaMatch4.1.15

sambasambaMatch4.1.16

sambasambaMatch4.1.17

sambasambaMatch4.1.18

sambasambaMatch4.1.19

sambasambaMatch4.1.20

sambasambaMatch4.1.21

sambasambaMatch4.1.22

sambasambaMatch4.1.23

sambasambaMatch4.2.0rc1

sambasambaMatch4.2.0rc2

sambasambaMatch4.2.0rc3

sambasambaMatch4.2.0rc4

sambasambaMatch4.2.1

sambasambaMatch4.2.2

sambasambaMatch4.2.3

sambasambaMatch4.2.4

sambasambaMatch4.2.5

sambasambaMatch4.2.6

sambasambaMatch4.2.7

sambasambaMatch4.2.8

sambasambaMatch4.2.9

sambasambaMatch4.3.0

sambasambaMatch4.3.1

sambasambaMatch4.3.2

sambasambaMatch4.3.3

sambasambaMatch4.3.4

sambasambaMatch4.3.5

sambasambaMatch4.3.6

sambasambaMatch4.4.0

Node

canonicalubuntu_linuxMatch14.04lts

canonicalubuntu_linuxMatch15.10

canonicalubuntu_linuxMatch16.04lts

CPENameOperatorVersion
samba:sambasambaeq3.0.0
samba:sambasambaeq3.0.1
samba:sambasambaeq3.0.2
samba:sambasambaeq3.0.2a
samba:sambasambaeq3.0.3
samba:sambasambaeq3.0.4
samba:sambasambaeq3.0.5
samba:sambasambaeq3.0.6
samba:sambasambaeq3.0.7
samba:sambasambaeq3.0.8

CPE	Name	Operator	Version
samba:samba	samba	eq	3.0.0
samba:samba	samba	eq	3.0.1
samba:samba	samba	eq	3.0.2
samba:samba	samba	eq	3.0.2a
samba:samba	samba	eq	3.0.3
samba:samba	samba	eq	3.0.4
samba:samba	samba	eq	3.0.5
samba:samba	samba	eq	3.0.6
samba:samba	samba	eq	3.0.7
samba:samba	samba	eq	3.0.8

Rows per page:

1-10 of 2221

References

badlock.org/

lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html

lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html

lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00046.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

lists.opensuse.org/opensuse-updates/2016-05/msg00124.html

rhn.redhat.com/errata/RHSA-2016-0611.html

rhn.redhat.com/errata/RHSA-2016-0612.html

rhn.redhat.com/errata/RHSA-2016-0613.html

rhn.redhat.com/errata/RHSA-2016-0614.html

rhn.redhat.com/errata/RHSA-2016-0618.html

rhn.redhat.com/errata/RHSA-2016-0619.html

rhn.redhat.com/errata/RHSA-2016-0620.html

rhn.redhat.com/errata/RHSA-2016-0621.html

rhn.redhat.com/errata/RHSA-2016-0623.html

rhn.redhat.com/errata/RHSA-2016-0624.html

rhn.redhat.com/errata/RHSA-2016-0625.html

www.debian.org/security/2016/dsa-3548

www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

www.securitytracker.com/id/1035533

www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012

www.ubuntu.com/usn/USN-2950-1

www.ubuntu.com/usn/USN-2950-2

www.ubuntu.com/usn/USN-2950-3

www.ubuntu.com/usn/USN-2950-4

www.ubuntu.com/usn/USN-2950-5

bto.bluecoat.com/security-advisory/sa122

h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05087821

h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05082964

h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05162399

security.gentoo.org/glsa/201612-47

www.samba.org/samba/history/samba-4.2.10.html

www.samba.org/samba/latest_news.html#4.4.2

www.samba.org/samba/security/CVE-2016-2110.html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

6.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.0%

JSON

CVE-2016-2110

Affected configurations

References

Related