Security Bulletin: Multiple vulnerabilities in Samba – including Badlock – affect ProtecTIER

Summary

Samba vulnerabilities were disclosed on April 12, 2016. Samba is used by ProtecTIER. ProtecTIER has addressed the applicable CVEs including the vulnerability commonly referred to as “Badlock”.

Vulnerability Details

CVEID: CVE-2016-2118 DESCRIPTION: Samba could allow a remote attacker to gain elevated privileges on the system, caused by the acceptance of inadequate authentication levels by the Microsoft Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote protocols. An attacker could exploit this vulnerability using man-in-the-middle techniques to impersonate an authenticated user against the SAMR or LSAD service and gain access to the Security Account Manager (SAM) database. This vulnerability is also known as the BADLOCK bug.
CVSS Base Score: 7.1
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/111935&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID: CVE-2015-5370 DESCRIPTION: Samba is vulnerable to a denial of service, caused by the improper validation of DCE-RPC packets by the DCE-RPC client and server implementations. An attacker could exploit this vulnerability using man-in-the-middle techniques to downgrade a secure connection to an insecure one and consume an overly large amount of CPU resources.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111936 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)

CVEID: CVE-2016-2110 DESCRIPTION: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to protect the feature negotiation of NTLMSSP from a downgrade. A remote attacker could exploit this vulnerability using man-in-the-middle techniques to clear NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL flags and perform downgrade attacks.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111937 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2111 DESCRIPTION: Samba could allow a remote attacker to conduct spoofing attacks, caused by an error in the NETLOGON service when a Domain Controller is configured. By logging into a domain joined system and observing network traffic, an attacker could exploit this vulnerability using a specially crafted application to connect to another domain joined system and access session-related information of the spoofed computer.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111938 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2112 DESCRIPTION: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to enforce integrity protection by the LDAP client and server. A remote attacker could exploit this vulnerability using man-in-the-middle techniques to downgrade LDAP connections.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111939 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-2115 DESCRIPTION: Samba could allow a remote attacker to bypass security restrictions, caused by the failure to protect the integrity of SMB client connections for IPC traffic. A remote attacker could exploit this vulnerability using man-in-the-middle techniques to perform unauthorized actions.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111942 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

These products affected by this vulnerability:

· ProtecTIER Enterprise Edition (PID 5639-PTA) - TS7650G
· ProtecTIER Appliance Edition (PID 5639-PTB) - TS7650AP1
· ProtecTIER Entry Edition (PID 5639-PTC) - TS7610 / TS7620

The code versions impacted are 3.2.x, 3.3.x and 3.4.x

Remediation/Fixes

<Product

| VRMF| APAR| Remediation/First Fix
—|—|—|—
ProtecTIER Enterprise Edition (PID 5639-PTA) - TS7650G| 3.3.x,
3.4.x|
| http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Tape%2Bvirtualization&product=ibm/Storage_Tape/TS7650G+with+ProtecTIER&release=All&platform=All&function=all
ProtecTIER Enterprise Edition (PID 5639-PTA) - TS7650G| 3.2.x|
| Contact support
ProtecTIER Appliance Edition (PID 5639-PTB) - TS7650AP1| 3.3.x,|
| http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Tape%2Bvirtualization&product=ibm/Storage_Tape/TS7650+ProtecTIER+Deduplication+Appliances&release=3.3&platform=All&function=all
ProtecTIER Appliance Edition (PID 5639-PTB) - TS7650AP1| 3.2.x|
| Contact support
ProtecTIER Entry Edition (PID 5639-PTC) | 3.3.x,
3.4.x|
| TS7620:
http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Tape%2Bvirtualization&product=ibm/Storage_Tape/TS7620+ProtecTIER+Deduplication+Appliance+Express&release=All&platform=All&function=all

TS7610:
http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=Tape%2Bvirtualization&product=ibm/Storage_Tape/TS7610+ProtecTIER+Deduplication+Appliance&release=All&platform=All&function=all
ProtecTIER Entry Edition (PID 5639-PTC) | 3.2.x|
| Contact support

Workarounds and Mitigations

None