CVE-2016-2112 - Vulncode-DB

CVE-2016-2112 (NVD)

2016-04-24

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

Products	Ubuntu_linux, Samba
Type	7PK - Security Features (CWE-254)
First patch	- None (likely due to unavailable code)
Links	• http://rhn.redhat.com/errata/RHSA-2016-0620.html • http://rhn.redhat.com/errata/RHSA-2016-0611.html • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html • https://www.samba.org/samba/latest_news.html#4.4.2 • http://www.ubuntu.com/usn/USN-2950-5 More/Less (32) • http://rhn.redhat.com/errata/RHSA-2016-0619.html • http://rhn.redhat.com/errata/RHSA-2016-0624.html • https://www.samba.org/samba/security/CVE-2016-2112.html • http://rhn.redhat.com/errata/RHSA-2016-0618.html • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html • http://www.securitytracker.com/id/1035533 • http://rhn.redhat.com/errata/RHSA-2016-0614.html • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html • https://www.samba.org/samba/history/samba-4.2.10.html • http://www.ubuntu.com/usn/USN-2950-1 • https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05082964 • http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html • https://security.gentoo.org/glsa/201612-47 • http://badlock.org/ • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html • http://www.ubuntu.com/usn/USN-2950-4 • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html • http://rhn.redhat.com/errata/RHSA-2016-0613.html • http://www.ubuntu.com/usn/USN-2950-3 • http://rhn.redhat.com/errata/RHSA-2016-0612.html • http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012 • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html • http://www.debian.org/security/2016/dsa-3548 • http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html • https://bto.bluecoat.com/security-advisory/sa122 • https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05162399 • https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05087821 • http://www.ubuntu.com/usn/USN-2950-2