CVE-2017-12150: debian debian_linux Channel Accessible by Non-Endpoint
CVSS: 7.4v3.0HighModified
AliasesALPINE-CVE-2017-12150UBUNTU-CVE-2017-12150DEBIAN-CVE-2017-12150
Published 26-07-2018Last modified 05-08-2024
Vulnerability summary
CVE-2017-12150 is a high (CVSS 7.4) Channel Accessible by Non-Endpoint vulnerability in debian debian_linux. EPSS estimates a 13.17% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.
CVSS score
7.4/10
010
High · v3.0 (CVE.org)EPSS score
13.17%
0%100%
Medium · -0.16 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 17 · Related 9Timeline
- 26-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
CVSS metrics
8 scores · 5 sources · 3 versionsHigh 7.4Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
High 7.4Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 3 agree
- NVDNIST7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
13.17%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
-0.16 pp
From 13.33% on 19-09-2026
19-09-202619-10-2026
EPSS score13.17%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat4 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_workstation6.0 | 7.0
- gluster_storage3.0
Debian2 products
- samba< 2:4.6.7+dfsg-2
- debian_linuxEOL8.0 | 9.0
Alpine1 product
- samba≥ 3.0.25, < 4.7.0-r0 | ≥ 3.0.25, < 4.4.16-r0 | ≥ 3.0.25, < 4.5.14-r0 | ≥ 3.0.25, < 4.6.8-r0
Samba1 product
- sambaEOL4.6.8 | 4.5.14 | 4.4.16 | 4.7.0 | ≥ 3.0.25, < 4.4.16 | ≥ 4.5.0, < 4.5.14 | ≥ 4.6.0, < 4.6.8
Ubuntu1 product
- samba< 2:4.3.11+dfsg-0ubuntu0.14.04.12 | < 2:4.3.11+dfsg-0ubuntu0.16.04.11
5 vendors · 9 products
References
19 links- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03775en_usX Refsource CONFIRMThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12150X Refsource CONFIRMIssue TrackingMitigationThird Party Advisory
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03817en_usX Refsource CONFIRMThird Party Advisory
