Test ID:	1.3.6.1.4.1.25623.1.0.807345
Category:	General
Title:	Samba 'libcli/smb/smbXcli_base.c' Man In The Middle (MIMA) Vulnerability
Summary:	Samba is prone to a man-in-the-middle (MITM) vulnerability.
Description:	Summary: Samba is prone to a man-in-the-middle (MITM) vulnerability. Vulnerability Insight: The flaw exists in the way DCE/RPC connections are initiated by the user. Any authenticated DCE/RPC connection that a client initiates against the server could be use by a man-in-the middle attacker to impersonate the server by injecting the SMB2_SESSION_FLAG_IS_GUEST or SMB2_SESSION_FLAG_IS_NULL flag. Vulnerability Impact: Successful exploitation will allow a remote attacker to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers. Affected Software/OS: Samba versions 4.x before 4.2.14, 4.3.x before 4.3.11, and 4.4.x before 4.4.5. Solution: Upgrade to Samba version 4.2.14 or 4.3.11 or 4.4.5 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-2119 BugTraq ID: 91700 http://www.securityfocus.com/bid/91700 https://security.gentoo.org/glsa/201805-07 RedHat Security Advisories: RHSA-2016:1486 http://rhn.redhat.com/errata/RHSA-2016-1486.html RedHat Security Advisories: RHSA-2016:1487 http://rhn.redhat.com/errata/RHSA-2016-1487.html RedHat Security Advisories: RHSA-2016:1494 http://rhn.redhat.com/errata/RHSA-2016-1494.html http://www.securitytracker.com/id/1036244 SuSE Security Announcement: openSUSE-SU-2016:1830 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-07/msg00060.html
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.