What’s Vulnerable › Vulnerabilities

CVE-2016-2118

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 36.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-04-12 · updated 2026-06-17
• Weakness: CWE-254

Description

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04
• Debian Linux: 7.0, 8.0
• Samba: from 3.6.0 before 4.2.10; from 4.3.0 before 4.3.7; from 4.4.0 before 4.4.1 — fixed in 4.2.10, 4.3.7, 4.4.1

How to fix

Upgrade to a fixed version: Samba 4.2.10, 4.3.7, 4.4.1. Check the vendor advisory for mitigations.

References

• http://badlock.org/
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182185.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182272.html
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182288.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00022.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00024.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

Get alerted when CVE-2016-2118 or the next vulnerability affects your stack