A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00604.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Canonical
  • Ubuntu Linux
Debian
  • Debian Linux
Fedoraproject
  • Fedora
Redhat
  • Codeready Linux Builder
  • Enterprise Linux
  • Enterprise Linux Desktop
  • Enterprise Linux Eus
  • Enterprise Linux For Ibm Z Systems
  • Enterprise Linux For Ibm Z Systems Eus
  • Enterprise Linux For Power Big Endian
  • Enterprise Linux For Power Little Endian
  • Enterprise Linux For Power Little Endian Eus
  • Enterprise Linux For Scientific Computing
  • Enterprise Linux Resilient Storage
  • Enterprise Linux Server
  • Enterprise Linux Server Aus
  • Enterprise Linux Server Tus
  • Enterprise Linux Server Update Services For Sap Solutions
  • Enterprise Linux Tus
  • Enterprise Linux Workstation
  • Gluster Storage
  • Openstack
  • Rhel Eus
  • Storage
  • Virtualization Host
Samba
  • Samba

Configuration 1 [-]

OR cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage:3.5:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openstack:16.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_resilient_storage:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 5 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 7
samba-0:4.10.16-17.el7_9 cpe:/o:redhat:enterprise_linux:7 RHSA-2021:5192 2021-12-16T00:00:00Z
Red Hat Enterprise Linux 8
samba-0:4.14.5-7.el8_5 cpe:/a:redhat:enterprise_linux:8 RHSA-2021:5082 2021-12-13T00:00:00Z
samba-0:4.14.5-7.el8_5 cpe:/o:redhat:enterprise_linux:8 RHSA-2021:5082 2021-12-13T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
samba-0:4.11.2-18.el8_2 cpe:/o:redhat:rhel_eus:8.2 RHSA-2022:0074 2022-01-11T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
samba-0:4.13.3-8.el8_4 cpe:/o:redhat:rhel_eus:8.4 RHSA-2022:0008 2022-01-04T00:00:00Z
Red Hat Gluster Storage 3.5 for RHEL 7
samba-0:4.11.6-114.el7rhgs cpe:/a:redhat:storage:3.5:samba:el7 RHSA-2021:4844 2021-11-29T00:00:00Z
Red Hat Gluster Storage 3.5 for RHEL 8
samba-0:4.14.5-204.el8rhgs cpe:/a:redhat:storage:3.5:samba:el8 RHSA-2021:4843 2021-11-29T00:00:00Z

No data.

References
Link Providers
https://bugzilla.redhat.com/show_bug.cgi?id=2019660 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2016-2124 cve-icon
https://security.gentoo.org/glsa/202309-06 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2016-2124 cve-icon
https://www.samba.org/samba/security/CVE-2016-2124.html cve-icon cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-05T23:17:50.581Z

Reserved: 2016-01-29T00:00:00

Link: CVE-2016-2124

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-02-18T18:15:08.237

Modified: 2024-11-21T02:47:52.757

Link: CVE-2016-2124

cve-icon Redhat

Severity : Moderate

Publid Date: 2021-11-09T00:00:00Z

Links: CVE-2016-2124 - Bugzilla

cve-icon OpenCVE Enrichment

No data.