What’s Vulnerable › Vulnerabilities
CVE-2016-2124
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-02-18 · updated 2026-06-17
- Weakness: CWE-287
Description
A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
Affected products
- Canonical Ubuntu Linux: 18.04, 20.04, 21.04, 21.10
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 33, 34, 35
- RedHat Codeready Linux Builder: all versions
- Red Hat Enterprise Linux: 7.0, 8.0
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Eus: 8.2, 8.4
- RedHat Enterprise Linux For Ibm Z Systems: 7.0, 8.0
- RedHat Enterprise Linux For Ibm Z Systems Eus: 8.2, 8.4
- RedHat Enterprise Linux For Power Big Endian: 7.0
- RedHat Enterprise Linux For Power Little Endian: 7.0, 8.0
- RedHat Enterprise Linux For Power Little Endian Eus: 8.2, 8.4
- RedHat Enterprise Linux For Scientific Computing: 7.0
- RedHat Enterprise Linux Resilient Storage: 7.0
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 8.2, 8.4
- RedHat Enterprise Linux Server Tus: 8.4
- RedHat Enterprise Linux Server Update Services For Sap Solutions: 8.2, 8.4
- RedHat Enterprise Linux Tus: 8.2
- RedHat Enterprise Linux Workstation: 7.0
- Red Hat, Inc. Gluster Storage for RHEL 6: 3.0, 3.5
- OpenStack: 13, 16.1, 16.2
- RedHat Virtualization Host: 4.0
- Samba: from 3.0.0 before 4.13.14; from 4.14.0 before 4.14.10; from 4.15.0 before 4.15.2 — fixed in 4.13.14, 4.14.10, 4.15.2
How to fix
Upgrade to a fixed version: Samba 4.13.14, 4.14.10, 4.15.2. Check the vendor advisory for mitigations.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2019660
- https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
- https://security.gentoo.org/glsa/202309-06
- https://www.samba.org/samba/security/CVE-2016-2124.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2019660
- https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
- https://security.gentoo.org/glsa/202309-06
- https://www.samba.org/samba/security/CVE-2016-2124.html
Get alerted when CVE-2016-2124 or the next vulnerability affects your stack