CVE-2016-2112

Published: Apr 25, 2016Modified: May 6, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

Affected (251)

Products: Samba: Samba · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

248 vulnerable

Vulnerable Software	Affected Versions
Samba Samba	Version 3.0.0
Samba Samba	Version 3.0.10
Samba Samba	Version 3.0.11
Samba Samba	Version 3.0.12
Samba Samba	Version 3.0.13
Samba Samba	Version 3.0.14
Samba Samba	Version 3.0.14 a
Samba Samba	Version 3.0.14a
Samba Samba	Version 3.0.15
Samba Samba	Version 3.0.16
Samba Samba	Version 3.0.17
Samba Samba	Version 3.0.18
Samba Samba	Version 3.0.19
Samba Samba	Version 3.0.1
Samba Samba	Version 3.0.20
Samba Samba	Version 3.0.20 a
Samba Samba	Version 3.0.20 b
Samba Samba	Version 3.0.20a
Samba Samba	Version 3.0.20b
Samba Samba	Version 3.0.21
Samba Samba	Version 3.0.21 a
Samba Samba	Version 3.0.21 b
Samba Samba	Version 3.0.21 c
Samba Samba	Version 3.0.21a
Samba Samba	Version 3.0.21b
Samba Samba	Version 3.0.21c
Samba Samba	Version 3.0.22
Samba Samba	Version 3.0.23
Samba Samba	Version 3.0.23 a
Samba Samba	Version 3.0.23 b
Samba Samba	Version 3.0.23 c
Samba Samba	Version 3.0.23 d
Samba Samba	Version 3.0.23a
Samba Samba	Version 3.0.23b
Samba Samba	Version 3.0.23c
Samba Samba	Version 3.0.23d
Samba Samba	Version 3.0.24
Samba Samba	Version 3.0.25
Samba Samba	Version 3.0.25 a
Samba Samba	Version 3.0.25 b
Samba Samba	Version 3.0.25 c
Samba Samba	Version 3.0.25 pre1
Samba Samba	Version 3.0.25 pre2
Samba Samba	Version 3.0.25 rc1
Samba Samba	Version 3.0.25 rc2
Samba Samba	Version 3.0.25 rc3
Samba Samba	Version 3.0.25a
Samba Samba	Version 3.0.25b
Samba Samba	Version 3.0.25c
Samba Samba	Version 3.0.26
Samba Samba	Version 3.0.26 a
Samba Samba	Version 3.0.26a
Samba Samba	Version 3.0.27
Samba Samba	Version 3.0.27 a
Samba Samba	Version 3.0.28
Samba Samba	Version 3.0.28 a
Samba Samba	Version 3.0.29
Samba Samba	Version 3.0.2
Samba Samba	Version 3.0.2 a
Samba Samba	Version 3.0.2a
Samba Samba	Version 3.0.30
Samba Samba	Version 3.0.31
Samba Samba	Version 3.0.32
Samba Samba	Version 3.0.33
Samba Samba	Version 3.0.34
Samba Samba	Version 3.0.35
Samba Samba	Version 3.0.36
Samba Samba	Version 3.0.37
Samba Samba	Version 3.0.3
Samba Samba	Version 3.0.4
Samba Samba	Version 3.0.4 rc1
Samba Samba	Version 3.0.5
Samba Samba	Version 3.0.6
Samba Samba	Version 3.0.7
Samba Samba	Version 3.0.8
Samba Samba	Version 3.0.9
Samba Samba	Version 3.2.0
Samba Samba	Version 3.2.10
Samba Samba	Version 3.2.11
Samba Samba	Version 3.2.12
Samba Samba	Version 3.2.13
Samba Samba	Version 3.2.14
Samba Samba	Version 3.2.15
Samba Samba	Version 3.2.1
Samba Samba	Version 3.2.2
Samba Samba	Version 3.2.3
Samba Samba	Version 3.2.4
Samba Samba	Version 3.2.5
Samba Samba	Version 3.2.6
Samba Samba	Version 3.2.7
Samba Samba	Version 3.2.8
Samba Samba	Version 3.2.9
Samba Samba	Version 3.3.0
Samba Samba	Version 3.3.10
Samba Samba	Version 3.3.11
Samba Samba	Version 3.3.12
Samba Samba	Version 3.3.13
Samba Samba	Version 3.3.14
Samba Samba	Version 3.3.15
Samba Samba	Version 3.3.16
Samba Samba	Version 3.3.1
Samba Samba	Version 3.3.2
Samba Samba	Version 3.3.3
Samba Samba	Version 3.3.4
Samba Samba	Version 3.3.5
Samba Samba	Version 3.3.6
Samba Samba	Version 3.3.7
Samba Samba	Version 3.3.8
Samba Samba	Version 3.3.9
Samba Samba	Version 3.4.0
Samba Samba	Version 3.4.10
Samba Samba	Version 3.4.11
Samba Samba	Version 3.4.12
Samba Samba	Version 3.4.13
Samba Samba	Version 3.4.14
Samba Samba	Version 3.4.15
Samba Samba	Version 3.4.16
Samba Samba	Version 3.4.17
Samba Samba	Version 3.4.1
Samba Samba	Version 3.4.2
Samba Samba	Version 3.4.3
Samba Samba	Version 3.4.4
Samba Samba	Version 3.4.5
Samba Samba	Version 3.4.6
Samba Samba	Version 3.4.7
Samba Samba	Version 3.4.8
Samba Samba	Version 3.4.9
Samba Samba	Version 3.5.0
Samba Samba	Version 3.5.10
Samba Samba	Version 3.5.11
Samba Samba	Version 3.5.12
Samba Samba	Version 3.5.13
Samba Samba	Version 3.5.14
Samba Samba	Version 3.5.15
Samba Samba	Version 3.5.16
Samba Samba	Version 3.5.17
Samba Samba	Version 3.5.18
Samba Samba	Version 3.5.19
Samba Samba	Version 3.5.1
Samba Samba	Version 3.5.20
Samba Samba	Version 3.5.21
Samba Samba	Version 3.5.22
Samba Samba	Version 3.5.2
Samba Samba	Version 3.5.3
Samba Samba	Version 3.5.4
Samba Samba	Version 3.5.5
Samba Samba	Version 3.5.6
Samba Samba	Version 3.5.7
Samba Samba	Version 3.5.8
Samba Samba	Version 3.5.9
Samba Samba	Version 3.6.0
Samba Samba	Version 3.6.10
Samba Samba	Version 3.6.11
Samba Samba	Version 3.6.12
Samba Samba	Version 3.6.13
Samba Samba	Version 3.6.14
Samba Samba	Version 3.6.15
Samba Samba	Version 3.6.16
Samba Samba	Version 3.6.17
Samba Samba	Version 3.6.18
Samba Samba	Version 3.6.19
Samba Samba	Version 3.6.1
Samba Samba	Version 3.6.20
Samba Samba	Version 3.6.21
Samba Samba	Version 3.6.22
Samba Samba	Version 3.6.23
Samba Samba	Version 3.6.24
Samba Samba	Version 3.6.25
Samba Samba	Version 3.6.2
Samba Samba	Version 3.6.3
Samba Samba	Version 3.6.4
Samba Samba	Version 3.6.5
Samba Samba	Version 3.6.6
Samba Samba	Version 3.6.7
Samba Samba	Version 3.6.8
Samba Samba	Version 3.6.9
Samba Samba	Version 4.0.0
Samba Samba	Version 4.0.10
Samba Samba	Version 4.0.11
Samba Samba	Version 4.0.12
Samba Samba	Version 4.0.13
Samba Samba	Version 4.0.14
Samba Samba	Version 4.0.15
Samba Samba	Version 4.0.16
Samba Samba	Version 4.0.17
Samba Samba	Version 4.0.18
Samba Samba	Version 4.0.19
Samba Samba	Version 4.0.1
Samba Samba	Version 4.0.20
Samba Samba	Version 4.0.21
Samba Samba	Version 4.0.22
Samba Samba	Version 4.0.23
Samba Samba	Version 4.0.24
Samba Samba	Version 4.0.25
Samba Samba	Version 4.0.26
Samba Samba	Version 4.0.2
Samba Samba	Version 4.0.3
Samba Samba	Version 4.0.4
Samba Samba	Version 4.0.5
Samba Samba	Version 4.0.6
Samba Samba	Version 4.0.7
Samba Samba	Version 4.0.8
Samba Samba	Version 4.0.9
Samba Samba	Version 4.1.0
Samba Samba	Version 4.1.10
Samba Samba	Version 4.1.11
Samba Samba	Version 4.1.12
Samba Samba	Version 4.1.13
Samba Samba	Version 4.1.14
Samba Samba	Version 4.1.15
Samba Samba	Version 4.1.16
Samba Samba	Version 4.1.17
Samba Samba	Version 4.1.18
Samba Samba	Version 4.1.19
Samba Samba	Version 4.1.1
Samba Samba	Version 4.1.20
Samba Samba	Version 4.1.21
Samba Samba	Version 4.1.22
Samba Samba	Version 4.1.23
Samba Samba	Version 4.1.2
Samba Samba	Version 4.1.3
Samba Samba	Version 4.1.4
Samba Samba	Version 4.1.5
Samba Samba	Version 4.1.6
Samba Samba	Version 4.1.7
Samba Samba	Version 4.1.8
Samba Samba	Version 4.1.9
Samba Samba	Version 4.2.0 rc1
Samba Samba	Version 4.2.0 rc2
Samba Samba	Version 4.2.0 rc3
Samba Samba	Version 4.2.0 rc4
Samba Samba	Version 4.2.1
Samba Samba	Version 4.2.2
Samba Samba	Version 4.2.3
Samba Samba	Version 4.2.4
Samba Samba	Version 4.2.5
Samba Samba	Version 4.2.6
Samba Samba	Version 4.2.7
Samba Samba	Version 4.2.8
Samba Samba	Version 4.2.9
Samba Samba	Version 4.3.0
Samba Samba	Version 4.3.1
Samba Samba	Version 4.3.2
Samba Samba	Version 4.3.3
Samba Samba	Version 4.3.4
Samba Samba	Version 4.3.5
Samba Samba	Version 4.3.6
Samba Samba	Version 4.4.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Related CWEs

CWE-254

References (74)

http://badlock.org/

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0611.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0612.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0613.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0614.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0618.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0619.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0620.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0624.html

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3548

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: secalert@redhat.com

http://www.securitytracker.com/id/1035533

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2950-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2950-2

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2950-3

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2950-4

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2950-5

Source: secalert@redhat.com

https://bto.bluecoat.com/security-advisory/sa122

Source: secalert@redhat.com

https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05087821

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05082964

Source: secalert@redhat.com

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05162399

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201612-47

Source: secalert@redhat.com

https://www.samba.org/samba/history/samba-4.2.10.html

Source: secalert@redhat.com

https://www.samba.org/samba/latest_news.html#4.4.2

Source: secalert@redhat.com

https://www.samba.org/samba/security/CVE-2016-2112.html

Source: secalert@redhat.com

PatchVendor Advisory

http://badlock.org/