Описание
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
It was found that samba did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
Меры по смягчению последствий
The missing implied signing for 'smb2mount -e', 'smbcacls -e' and 'smbcquotas -e' can be enforced by explicitly using '--signing=required' on the commandline or "client signing = required" in smb.conf.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | samba | Will not fix | ||
| Red Hat Enterprise Linux 5 | samba3x | Will not fix | ||
| Red Hat Enterprise Linux 6 | samba | Fixed | RHSA-2017:2789 | 21.09.2017 |
| Red Hat Enterprise Linux 6 | samba4 | Fixed | RHSA-2017:2791 | 21.09.2017 |
| Red Hat Enterprise Linux 7 | samba | Fixed | RHSA-2017:2790 | 21.09.2017 |
| Red Hat Gluster Storage 3.3 for RHEL 6 | samba | Fixed | RHSA-2017:2858 | 04.10.2017 |
| Red Hat Gluster Storage 3.3 for RHEL 7 | samba | Fixed | RHSA-2017:2858 | 04.10.2017 |
Показывать по
Дополнительная информация
Статус:
7.4 High
CVSS3
Связанные уязвимости
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x ...
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
7.4 High
CVSS3