Description

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream.

References

http://badlock.org/

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

http://rhn.redhat.com/errata/RHSA-2016-0611.html

http://rhn.redhat.com/errata/RHSA-2016-0612.html

http://rhn.redhat.com/errata/RHSA-2016-0613.html

http://rhn.redhat.com/errata/RHSA-2016-0614.html

http://rhn.redhat.com/errata/RHSA-2016-0618.html

http://rhn.redhat.com/errata/RHSA-2016-0619.html

http://rhn.redhat.com/errata/RHSA-2016-0620.html

http://rhn.redhat.com/errata/RHSA-2016-0624.html

http://www.debian.org/security/2016/dsa-3548

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

http://www.securitytracker.com/id/1035533

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.458012

http://www.ubuntu.com/usn/USN-2950-1

http://www.ubuntu.com/usn/USN-2950-2

http://www.ubuntu.com/usn/USN-2950-3

http://www.ubuntu.com/usn/USN-2950-4

http://www.ubuntu.com/usn/USN-2950-5

https://bto.bluecoat.com/security-advisory/sa122

https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05087821

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05082964

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05162399

https://security.gentoo.org/glsa/201612-47

https://www.samba.org/samba/history/samba-4.2.10.html

https://www.samba.org/samba/latest_news.html#4.4.2

https://www.samba.org/samba/security/CVE-2016-2112.html

Details

Risk Information

CVSS v2

CVSS v3