CVE-2016-2125

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287 CWE-20

Affected software

Vendor	Product	Versions
[UNKNOWN]	samba	4.5.3; 4.4.8; 4.3.13

References

http://rhn.redhat.com/errata/RHSA-2017-0494.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0495.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0662.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0744.htmlThird Party Advisory
http://www.securityfocus.com/bid/94988Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037494Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1265Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2125Issue Tracking, Mitigation, Third Party Advisory
https://www.samba.org/samba/security/CVE-2016-2125.htmlMitigation, Patch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0494.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0495.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0662.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0744.htmlThird Party Advisory
http://www.securityfocus.com/bid/94988Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037494Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1265Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2125Issue Tracking, Mitigation, Third Party Advisory
https://www.samba.org/samba/security/CVE-2016-2125.htmlMitigation, Patch, Vendor Advisory

Timeline

Published: Oct 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-21266.5Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) CVE-2016-21386.4In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.class.php.CVE-2016-21396.4In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.class.php.CVE-2016-21405.3The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow CVE-2016-21419.8It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker c CVE-2016-21425.5Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allo CVE-2016-21437.8The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local u CVE-2016-21457.5The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which a CVE-2016-21467.5The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cau CVE-2016-21477.5Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a mal CVE-2016-21489.8Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vecto CVE-2016-21496.5Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a prev