CVE-2016-2119: samba Improper Control of Generation of Code

Modified

AliasesSUSE-SU-2016:2306-1SUSE-SU-2016:2570-1RHSA-2016:1486+5 more

Published 07-07-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-2119 is a high (CVSS 7.5) Improper Control of Generation of Code vulnerability in samba. EPSS estimates a 3.10% chance of exploitation in the next 30 days, higher than 87.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

3.10%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

DSA-3740-1 OPENSUSE-SU-2024:10069-1

Timeline

07-07-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag.

CVSS metrics

6 scores · 4 sources · 3 versions

v3.17.5v3.07.5v2.06.8

EPSS trend

Probability

3.10%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.10% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat42 products

ctdb< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
ctdb-devel< 0:4.2.10-7.el7_2
ctdb-tests< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
libsmbclient< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
libsmbclient-devel< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs

libwbclient< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
libwbclient-devel< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-client< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-client-libs< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-common< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-common-libs< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-common-tools< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-dc< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-dc-libs< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-debuginfo< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-devel< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-libs< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-pidl< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-python< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-test< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-test-devel< 0:4.2.10-7.el7_2
samba-test-libs< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-vfs-glusterfs< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-winbind< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-winbind-clients< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-winbind-krb5-locator< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba-winbind-modules< 0:4.2.10-7.el7_2 | < 0:4.4.3-8.el6rhs | < 0:4.4.3-8.el7rhgs
samba4< 0:4.2.10-7.el6_8
samba4-client< 0:4.2.10-7.el6_8
samba4-common< 0:4.2.10-7.el6_8
samba4-dc< 0:4.2.10-7.el6_8
samba4-dc-libs< 0:4.2.10-7.el6_8
samba4-debuginfo< 0:4.2.10-7.el6_8
samba4-devel< 0:4.2.10-7.el6_8
samba4-libs< 0:4.2.10-7.el6_8
samba4-pidl< 0:4.2.10-7.el6_8
samba4-python< 0:4.2.10-7.el6_8
samba4-test< 0:4.2.10-7.el6_8
samba4-winbind< 0:4.2.10-7.el6_8
samba4-winbind-clients< 0:4.2.10-7.el6_8
samba4-winbind-krb5-locator< 0:4.2.10-7.el6_8

Show all 42

Suse6 products

samba&distro=SUSE Linux Enterprise Desktop 12 SP1< 4.2.4-26.2
samba&distro=SUSE Linux Enterprise High Availability Extension 12 SP1< 4.2.4-26.2
samba&distro=SUSE Linux Enterprise Server 12 SP1< 4.2.4-26.2
samba&distro=SUSE Linux Enterprise Server 12-LTSS< 4.2.4-18.27.9
samba&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1< 4.2.4-26.2

Show all 6

Debian1 product

samba< 2:4.4.5+dfsg-1

Samba1 product

samba≥ 4.0.0, < 4.2.14 | ≥ 4.3.0, < 4.3.11 | ≥ 4.4.0, < 4.4.5

Ubuntu1 product

samba< 2:4.3.11+dfsg-0ubuntu0.14.04.1 | < 2:4.3.11+dfsg-0ubuntu0.16.04.1

5 vendors · 51 products

References

35 links

www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlX Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-1494.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/bid/91700VDB EntryX Refsource BIDThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-1486.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/201805-07Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.opensuse.org/opensuse-updates/2016-07/msg00060.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-1487.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securitytracker.com/id/1036244VDB EntryX Refsource SECTRACKThird Party Advisory
www.samba.org/samba/security/CVE-2016-2119.htmlX Refsource CONFIRMVendor AdvisoryREPORT
www.suse.com/support/update/announcement/2016/suse-su-20162306-1/Advisory

Show all 35 references

bugzilla.suse.com/969522REPORT
bugzilla.suse.com/975131REPORT
bugzilla.suse.com/981566REPORT
bugzilla.suse.com/986228REPORT
bugzilla.suse.com/986869REPORT
bugzilla.suse.com/991564REPORT
www.suse.com/security/cve/CVE-2016-2119WEB
www.suse.com/support/update/announcement/2016/suse-su-20162570-1/Advisory
bugzilla.suse.com/1005065REPORT
access.redhat.com/errata/RHSA-2016:1486Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1350759REPORT
bugzilla.redhat.com/show_bug.cgi?id=1351260REPORT
bugzilla.redhat.com/show_bug.cgi?id=1351955REPORT
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1486.jsonAdvisory
access.redhat.com/security/cve/CVE-2016-2119REPORT
www.cve.org/CVERecord?id=CVE-2016-2119AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2016-2119Advisory
access.redhat.com/errata/RHSA-2016:1487Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1487.jsonAdvisory
access.redhat.com/errata/RHSA-2016:1494Advisory
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1494.jsonAdvisory
ubuntu.com/security/CVE-2016-2119REPORT
ubuntu.com/security/notices/USN-3092-1Advisory
security-tracker.debian.org/tracker/CVE-2016-2119Advisory