CVE-2017-12151
Summary
| CVE | CVE-2017-12151 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-07-27 12:29:00 UTC |
|---|
| Updated | 2019-10-09 23:22:00 UTC |
|---|
| Description | A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| Document Display | HPE Support Center |
CONFIRM |
support.hpe.com |
Third Party Advisory |
| Samba - Security Announcement Archive |
CONFIRM |
www.samba.org |
Mitigation, Vendor Advisory |
| 1488197 – (CVE-2017-12151) CVE-2017-12151 samba: SMB2 connections don't keep encryption across DFS redirects |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking, Third Party Advisory |
| Debian -- Security Information -- DSA-3983-1 samba |
DEBIAN |
www.debian.org |
Third Party Advisory |
| Samba CVE-2017-12151 Man in the Middle Security Bypass Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| Samba Multiple Flaws Let Remote Users Hijack Connections and Remote Authenticated Users Obtain Potentially Sensitive Information - SecurityTracker |
SECTRACK |
www.securitytracker.com |
Third Party Advisory, VDB Entry |
| September 2017 Samba Vulnerabilities in NetApp StorageGRID Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 500632 Alpine Linux Security Update for samba
- 504396 Alpine Linux Security Update for samba
