Samba up to 4.4.15/4.5.12/4.6.7 DFS cryptographic issues

entryeditHistoryDiffjsonxmlCTI

A vulnerability, which was classified as critical, has been found in Samba up to 4.4.15/4.5.12/4.6.7 (File Transfer Software). This issue affects an unknown part of the component DFS. Upgrading to version 4.4.16, 4.5.14 or 4.6.8 eliminates this vulnerability. A possible mitigation has been published 3 weeks after the disclosure of the vulnerability.

Field11/19/2019 10:27 AM01/14/2021 11:25 AM01/14/2021 11:30 AM
typeFile Transfer SoftwareFile Transfer SoftwareFile Transfer Software
nameSambaSambaSamba
version<=4.4.15/4.5.12/4.6.7<=4.4.15/4.5.12/4.6.7<=4.4.15/4.5.12/4.6.7
componentDFSDFSDFS
cwe310 (weak encryption)310 (weak encryption)310 (weak encryption)
risk222
historic000
cvss2_vuldb_basescore6.86.86.8
cvss2_vuldb_tempscore5.95.95.9
cvss2_vuldb_avNNN
cvss2_vuldb_acMMM
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_nvd_avNNN
cvss2_nvd_acMMM
cvss2_nvd_auNNN
cvss2_nvd_ciPPP
cvss2_nvd_iiPPP
cvss2_nvd_aiNNN
cvss3_meta_basescore6.56.56.5
cvss3_meta_tempscore6.26.26.2
cvss3_vuldb_basescore5.65.65.6
cvss3_vuldb_tempscore5.45.45.4
cvss3_vuldb_avNNN
cvss3_vuldb_acHHH
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_nvd_avNNN
cvss3_nvd_acHHH
cvss3_nvd_prNNN
cvss3_nvd_uiNNN
cvss3_nvd_sUUU
cvss3_nvd_cHHH
cvss3_nvd_iHHH
cvss3_nvd_aNNN
date1505952000 (09/21/2017)1505952000 (09/21/2017)1505952000 (09/21/2017)
locationWebsiteWebsiteWebsite
typeAdvisoryAdvisoryAdvisory
urlhttps://www.samba.org/samba/security/CVE-2017-12150.htmlhttps://www.samba.org/samba/security/CVE-2017-12150.htmlhttps://www.samba.org/samba/security/CVE-2017-12150.html
disputed000
price_0day$0-$5k$0-$5k$0-$5k
nameUpgradeUpgradeUpgrade
upgrade_version4.4.16/4.5.14/4.6.84.4.16/4.5.14/4.6.84.4.16/4.5.14/4.6.8
cveCVE-2017-12151CVE-2017-12151CVE-2017-12151
cve_nvd_published153264240015326424001532642400
oval_idoval:org.cisecurity:def:3313oval:org.cisecurity:def:3313oval:org.cisecurity:def:3313
securityfocus100917100917100917
securityfocus_titleSamba CVE-2017-12151 Man in the Middle Security Bypass VulnerabilitySamba CVE-2017-12151 Man in the Middle Security Bypass VulnerabilitySamba CVE-2017-12151 Man in the Middle Security Bypass Vulnerability
sectracker103940110394011039401
sectracker_date1505952000 (09/21/2017)1505952000 (09/21/2017)1505952000 (09/21/2017)
sectracker_causeAccess control errorAccess control errorAccess control error
nessus_id103801103801103801
nessus_nameopenSUSE Security Update : samba (openSUSE-2017-1147)openSUSE Security Update : samba (openSUSE-2017-1147)openSUSE Security Update : samba (openSUSE-2017-1147)
nessus_filenameopenSUSE-2017-1147.naslopenSUSE-2017-1147.naslopenSUSE-2017-1147.nasl
nessus_riskMediumMediumMedium
nessus_familySuSE Local Security ChecksSuSE Local Security ChecksSuSE Local Security Checks
nessus_typelocallocallocal
nessus_date1507766400 (10/12/2017)1507766400 (10/12/2017)1507766400 (10/12/2017)
openvas_id537545375453754
openvas_filenamedeb_3983.nasldeb_3983.nasldeb_3983.nasl
openvas_titleDebian Security Advisory DSA 3983-1 (samba - security update)Debian Security Advisory DSA 3983-1 (samba - security update)Debian Security Advisory DSA 3983-1 (samba - security update)
openvas_familyDebian Local Security ChecksDebian Local Security ChecksDebian Local Security Checks
qualys_id236503236503236503
qualys_titleRed Hat Update for samba (RHSA-2017:2790)Red Hat Update for samba (RHSA-2017:2790)Red Hat Update for samba (RHSA-2017:2790)
seealso107074 107076107074 107076107074 107076
cvss2_vuldb_eNDNDND
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_rcCCC
cvss3_vuldb_eXXX
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
reaction_days202020
exposure_days202020
cvss3_nvd_basescore7.47.47.4
discoverydate150595200015059520001505952000
person_nameStefan MetzmacherStefan MetzmacherStefan Metzmacher
confirm_urlhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12151https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12151https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12151
date1507680000 (10/11/2017)1507680000 (10/11/2017)1507680000 (10/11/2017)
cve_assigned150154560015015456001501545600
securityfocus_date1505865600 (09/20/2017)1505865600 (09/20/2017)1505865600 (09/20/2017)
securityfocus_classDesign ErrorDesign ErrorDesign Error
cve_nvd_summaryA flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.
cvss2_nvd_basescore5.85.8
cve_cnaRed Hat, Inc.

◂ PreviousOverviewNext ▸

Do you know our Splunk app?

Download it now for free!