Samba CVE-2017-12150 Man in the Middle Security Bypass Vulnerability
BID:100918
CVE-2017-12150 |Info
Samba CVE-2017-12150 Man in the Middle Security Bypass Vulnerability
| Bugtraq ID: | 100918 |
| Class: | Design Error |
| CVE: |
CVE-2017-12150 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 20 2017 12:00AM |
| Updated: | Oct 03 2017 09:01AM |
| Credit: | Stefan Metzmacher |
| Vulnerable: |
Ubuntu Ubuntu Linux 16.04 LTS Ubuntu Ubuntu Linux 14.04 LTS Samba Samba 4.6.7 Samba Samba 4.6.6 Samba Samba 4.6.4 Samba Samba 4.6.1 Samba Samba 4.6 Samba Samba 4.5.13 Samba Samba 4.5.12 Samba Samba 4.5.10 Samba Samba 4.5.7 Samba Samba 4.5.6 Samba Samba 4.5.5 Samba Samba 4.5.4 Samba Samba 4.5.1 Samba Samba 4.5 Samba Samba 4.4.15 Samba Samba 4.4.14 Samba Samba 4.4.12 Samba Samba 4.4.11 Samba Samba 4.4.10 Samba Samba 4.4.9 Samba Samba 4.4.7 Samba Samba 4.4.6 Samba Samba 4.4.1 Samba Samba 4.4 Samba Samba 4.3.7 Samba Samba 4.3.5 Samba Samba 4.3.4 Samba Samba 4.3.3 Samba Samba 4.3.2 Samba Samba 4.3.1 Samba Samba 4.3 Samba Samba 4.2.10 Samba Samba 4.2.8 Samba Samba 4.2.7 Samba Samba 4.2.6 Samba Samba 4.2.5 Samba Samba 4.2.4 Samba Samba 4.2.3 Samba Samba 4.2.2 Samba Samba 4.2.1 Samba Samba 4.2 Samba Samba 4.1.22 Samba Samba 4.1.21 Samba Samba 4.1.20 Samba Samba 4.1.19 Samba Samba 4.1.18 Samba Samba 4.1.17 Samba Samba 4.1.16 Samba Samba 4.1.15 Samba Samba 4.1.14 Samba Samba 4.1.13 Samba Samba 4.1.10 Samba Samba 4.1.9 Samba Samba 4.1.7 Samba Samba 4.1.3 Samba Samba 4.1.2 Samba Samba 4.1.1 Samba Samba 4.1 Samba Samba 4.0.24 Samba Samba 4.0.23 Samba Samba 4.0.21 Samba Samba 4.0.20 Samba Samba 4.0.19 Samba Samba 4.0.18 Samba Samba 4.0.17 Samba Samba 4.0.13 Samba Samba 4.0.12 Samba Samba 4.0.10 Samba Samba 4.0.2 Samba Samba 3.6.24 Samba Samba 3.6.23 Samba Samba 3.6.22 Samba Samba 3.6.21 Samba Samba 3.6.20 Samba Samba 3.6.19 Samba Samba 3.6.12 Samba Samba 3.6.4 Samba Samba 3.6.3 Samba Samba 3.6.2 Samba Samba 3.6.1 Samba Samba 3.6 Samba Samba 3.5.22 Samba Samba 3.5.21 Samba Samba 3.5.16 Samba Samba 3.5.9 Samba Samba 3.5.8 Samba Samba 3.5.2 Samba Samba 3.5.1 Samba Samba 3.5 Samba Samba 3.4.15 Samba Samba 3.4.14 Samba Samba 3.4.13 Samba Samba 3.4.12 Samba Samba 3.4.11 Samba Samba 3.4.10 Samba Samba 3.4.8 Samba Samba 3.4.7 Samba Samba 3.4.6 Samba Samba 3.4.5 Samba Samba 3.4.2 Samba Samba 3.4.1 Samba Samba 3.4 Samba Samba 3.3.16 Samba Samba 3.3.15 Samba Samba 3.3.14 Samba Samba 3.3.13 Samba Samba 3.3.12 Samba Samba 3.3.11 Samba Samba 3.3.10 Samba Samba 3.3.9 Samba Samba 3.3.8 Samba Samba 3.3.7 Samba Samba 3.3.6 Samba Samba 3.3.5 Samba Samba 3.3.4 Samba Samba 3.3.3 Samba Samba 3.3.1 Samba Samba 3.3 Samba Samba 3.2.15 Samba Samba 3.2.14 Samba Samba 3.2.13 Samba Samba 3.2.12 Samba Samba 3.2.11 Samba Samba 3.2.10 Samba Samba 3.2.7 Samba Samba 3.2.6 Samba Samba 3.2.5 Samba Samba 3.2.4 Samba Samba 3.2.3 Samba Samba 3.2.2 Samba Samba 3.2.1 Samba Samba 3.2 Samba Samba 3.0.37 Samba Samba 3.0.36 Samba Samba 3.0.35 Samba Samba 3.0.34 Samba Samba 3.0.33 Samba Samba 3.0.32 Samba Samba 3.0.31 Samba Samba 3.0.30 Samba Samba 3.0.29 Samba Samba 3.0.28 Samba Samba 3.0.27 Samba Samba 3.0.26 Samba Samba 3.0.25 Samba Samba 4.5.3 Samba Samba 4.5.2 Samba Samba 4.4.8 Samba Samba 4.4.5 Samba Samba 4.4.4 Samba Samba 4.4.3 Samba Samba 4.4.2 Samba Samba 4.3.9 Samba Samba 4.3.8 Samba Samba 4.3.6 Samba Samba 4.3.13 Samba Samba 4.3.11 Samba Samba 4.3.10 Samba Samba 4.2.9 Samba Samba 4.2.14 Samba Samba 4.2.13 Samba Samba 4.2.12 Samba Samba 4.2.11 Samba Samba 4.1.8 Samba Samba 4.1.6 Samba Samba 4.1.5 Samba Samba 4.1.4 Samba Samba 4.1.23 Samba Samba 4.1.11 Samba Samba 4.0.9 Samba Samba 4.0.8 Samba Samba 4.0.7 Samba Samba 4.0.6 Samba Samba 4.0.5 Samba Samba 4.0.4 Samba Samba 4.0.3 Samba Samba 4.0.22 Samba Samba 4.0.16 Samba Samba 4.0.15 Samba Samba 4.0.14 Samba Samba 4.0.11 Samba Samba 4.0.1 Samba Samba 4.0.0 Samba Samba 3.6.9 Samba Samba 3.6.8 Samba Samba 3.6.7 Samba Samba 3.6.6 Samba Samba 3.6.5 Samba Samba 3.6.18 Samba Samba 3.6.17 Samba Samba 3.6.16 Samba Samba 3.6.15 Samba Samba 3.6.14 Samba Samba 3.6.13 Samba Samba 3.6.11 Samba Samba 3.6.10 Samba Samba 3.5.7 Samba Samba 3.5.6 Samba Samba 3.5.5 Samba Samba 3.5.4 Samba Samba 3.5.3 Samba Samba 3.5.20 Samba Samba 3.5.19 Samba Samba 3.5.18 Samba Samba 3.5.17 Samba Samba 3.5.15 Samba Samba 3.5.14 Samba Samba 3.5.12 Samba Samba 3.5.11 Samba Samba 3.5.10 Samba Samba 3.5 Samba Samba 3.4.9 Samba Samba 3.4.4 Samba Samba 3.4.3 Samba Samba 3.4.17 Samba Samba 3.4.16 Samba Samba 3.3.2 Samba Samba 3.2.9 Samba Samba 3.2.8 Samba Samba 3.1.0 Samba Samba 3.1 Redhat Gluster Storage 3.0 Redhat Enterprise Linux Workstation 7 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server for ARM 7 Redhat Enterprise Linux Server - TUS 7.4 Redhat Enterprise Linux Server - Extended Update Support 7.4 Redhat Enterprise Linux Server - AUS 7.4 Redhat Enterprise Linux Server - 4 Year Extended Update Support 7.4 Redhat Enterprise Linux Server (for IBM Power LE) - 4 Year Extended Update Support 7.4 Redhat Enterprise Linux Server 7 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux Resilient Storage (for RHEL Server) - Extended Update Support 7.4 Redhat Enterprise Linux Resilient Storage (for RHEL Server) 7 Redhat Enterprise Linux Resilient Storage (for IBM z Systems) 7 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux for Scientific Computing 7 Redhat Enterprise Linux for Scientific Computing 6 Redhat Enterprise Linux for Power, little endian - Extended Update Supp 7.4 Redhat Enterprise Linux for Power, little endian 7 Redhat Enterprise Linux for Power, big endian - Extended Update Support 7.4 Redhat Enterprise Linux for Power, big endian 7 Redhat Enterprise Linux for Power, big endian 6 Redhat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 Redhat Enterprise Linux for IBM z Systems 7 Redhat Enterprise Linux for IBM z Systems 6 Redhat Enterprise Linux EUS Compute Node 7.4 Redhat Enterprise Linux Desktop 7 Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux Client Optional 7 Redhat Enterprise Linux 7 Client Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 Redhat Enterprise Linux 5 HP NonStop T1201L01^AAO HP NonStop T1201L01^AAL HP NonStop T1201L01 HP NonStop T1201H01^AAN HP NonStop T1201H01^AAM HP NonStop T1201H01 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Samba Samba 4.6.8 Samba Samba 4.5.14 Samba Samba 4.4.16 HP NonStop T1201L01^AAQ HP NonStop T1201H01^AAP |
Discussion
Samba CVE-2017-12150 Man in the Middle Security Bypass Vulnerability
Samba is prone to a security-bypass vulnerability.
Successfully exploiting this issue may allow attackers to bypass security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks.
The following versions are vulnerable:
Samba 3.0.25 through 4.4.15
Samba 4.5.x versions prior to 4.5.14
Samba 4.6.x versions prior to 4.6.8
Samba is prone to a security-bypass vulnerability.
Successfully exploiting this issue may allow attackers to bypass security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks.
The following versions are vulnerable:
Samba 3.0.25 through 4.4.15
Samba 4.5.x versions prior to 4.5.14
Samba 4.6.x versions prior to 4.6.8
Exploit / POC
Samba CVE-2017-12150 Man in the Middle Security Bypass Vulnerability
Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: malto:[email protected].
Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: malto:[email protected].
Solution / Fix
Samba CVE-2017-12150 Man in the Middle Security Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Samba CVE-2017-12150 Man in the Middle Security Bypass Vulnerability
References:
References:
- Release Notes for Samba 4.4.16 (Samba)
- Release Notes for Samba 4.5.14 (Samba)
- Release Notes for Samba 4.6.8 (Samba)
- Samba Homepage (Samba)
- CVE-2017-12150 (Redhat)
- HPESBNS03775 rev.1 - HPE NonStop Samba, Remote Disclosure of Information, Authen (HP)
- RHSA-2017:2789 - Security Advisory (Red Hat)
- Samba Security Releases (samba)
- SMB1/2/3 connections may not require signing where they should (Samba)