Description
The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as demonstrated by clearing the NTLMSSP_NEGOTIATE_SEAL or NTLMSSP_NEGOTIATE_SIGN option to disrupt LDAP security.
Analysis and contextual insights are available on OpenCVE Cloud.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-3548-1 | samba security update |
Ubuntu USN |
USN-2950-1 | Samba vulnerabilities |
References
History
No history.
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-05T23:17:50.577Z
Reserved: 2016-01-29T00:00:00.000Z
Link: CVE-2016-2110
No data.
Status : Modified
Published: 2016-04-25T00:59:01.113
Modified: 2026-05-06T22:30:45.220
Link: CVE-2016-2110
OpenCVE Enrichment
No data.
Debian DSA
Ubuntu USN