CVE
CVE-2016-2112
The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.
- Severity
- MEDIUM
- CVSS
- 5.9
- Published
- Modified
Linked Releases
| Distribution | Release | Status | Evidence |
|---|---|---|---|
| Ubuntu | 16.04.7 amd64 desktop | unknown | source |
| Ubuntu | 16.04.6 i386 desktop | unknown | source |
| Ubuntu | 16.04.7 amd64 server | unknown | source |
| Ubuntu | 16.04.6 i386 server | unknown | source |
| Ubuntu | 14.04.6 amd64 desktop | unknown | source |
| Ubuntu | 14.04.6 i386 desktop | unknown | source |
| Ubuntu | 14.04.6 amd64 server | unknown | source |
| Ubuntu | 14.04.6 i386 server | unknown | source |
References
- http://badlock.org/
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html
- http://rhn.redhat.com/errata/RHSA-2016-0611.html
- http://rhn.redhat.com/errata/RHSA-2016-0612.html
- http://rhn.redhat.com/errata/RHSA-2016-0613.html
- http://rhn.redhat.com/errata/RHSA-2016-0614.html
- http://rhn.redhat.com/errata/RHSA-2016-0618.html
- http://rhn.redhat.com/errata/RHSA-2016-0619.html
- http://rhn.redhat.com/errata/RHSA-2016-0620.html
- http://rhn.redhat.com/errata/RHSA-2016-0624.html