CVE-2016-2119

    Dashboard / Vulnerabilities / CVE-2016-2119

    CVE-2016-2119

    Published: 7 Jul 2016Last Modified: 24 Oct 2026

    Summary:

    Details: libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag.

    References: http://lists.opensuse.org/opensuse-updates/2016-07/msg00060.html, http://rhn.redhat.com/errata/RHSA-2016-1486.html, http://rhn.redhat.com/errata/RHSA-2016-1487.html, http://rhn.redhat.com/errata/RHSA-2016-1494.html, http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html, http://www.securityfocus.com/bid/91700, http://www.securitytracker.com/id/1036244, https://security.gentoo.org/glsa/201805-07, https://www.samba.org/samba/security/CVE-2016-2119.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- df33344d8eb40221d60c99931690703a11d91bc2
    Fixed -c7c5fe127366aa8edb69247f80a4e015969cf1b3

    Affected versions

    samba-4.3.10
    samba-4.3.9
    samba-4.3.5
    samba-4.3.4
    samba-4.3.2
    samba-4.3.1
    samba-4.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2016-2119 | CVE-DB