CVE-2016-2125
Public on 2017-05-30
Modified on 2017-05-31
Description
It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.
Severity
Medium
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | samba | 2017-05-30 | ALAS-2017-834 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv2 | 4.3 | AV:A/AC:M/Au:N/C:P/I:P/A:N |
| Amazon Linux | CVSSv3 | 6.4 | CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVD | CVSSv2 | 3.3 | AV:A/AC:L/Au:N/C:P/I:N/A:N |
| NVD | CVSSv3 | 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |