The version of Samba running on the remote host is 4.x prior to 4.2.14, 4.3.x prior to 4.3.11, or 4.4.x prior to 4.4.5. It is, therefore, affected by a flaw in libcli/smb/smbXcli_base.c that is triggered when handling SMB2 and SMB3 client connections. A man-in-the-middle attacker can exploit this, by injecting the SMB2_SESSION_FLAG_IS_GUEST or SMB2_SESSION_FLAG_IS_NULL flags, to downgrade the required signing for a client connection, allowing the attacker to spoof SMB2 and SMB3 servers.

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* A flaw was found in the way Samba initiated signed DCE/RPC connections. A man-in-the-middle attacker could use this flaw to downgrade the connection to not use signing and therefore impersonate the server. (CVE-2016-2119)

Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Stefan Metzmacher as the original reporter.

Bug Fix(es) :

* Previously, the 'net' command in some cases failed to join the client to Active Directory (AD) because the permissions setting prevented modification of the supported Kerberos encryption type LDAP attribute. With this update, Samba has been fixed to allow joining an AD domain as a user. In addition, Samba now uses the machine account credentials to set up the Kerberos encryption types within AD for the joined machine. As a result, using 'net' to join a domain now works more reliably. (BZ#1351260)

* Previously, the idmap_hash module worked incorrectly when it was used together with other modules. As a consequence, user and group IDs were not mapped properly. A patch has been applied to skip already configured modules. Now, the hash module can be used as the default idmap configuration back end and IDs are resolved correctly.
(BZ#1350759)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-577:04 advisory.

    Samba is the standard Windows interoperability suite of programs for Linux and Unix.
    Security issues fixed with this release:
    CVE-2016-2119     libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before     4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to     bypass a client-signing protection mechanism, and consequently spoof     SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2)     SMB2_SESSION_FLAG_IS_NULL flag.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for samba provides the following fixes :

  - CVE-2016-2119: Prevent client-side SMB2 signing     downgrade. (bsc#986869)

  - Fix possible ctdb crash when opening sockets with     htons(IPPROTO_RAW). (bsc#969522)

  - Honor smb.conf socket options in winbind. (bsc#975131)

  - Fix ntlm-auth segmentation fault with squid.
    (bsc#986228)

  - Implement new '--no-dns-updates' option in 'net ads'     command. (bsc#991564)

  - Fix population of ctdb sysconfig after source merge.
    (bsc#981566) This update was imported from the     SUSE:SLE-12-SP1:Update project.

This update for samba provides the following fix: Following security issue was fixed :

  - CVE-2016-2119: Prevent client-side SMB2 signing     downgrade. (bsc#986869) Also the following bugs were     fixed :

  - Fix possible ctdb crash when opening sockets with     htons(IPPROTO_RAW). (bsc#969522)

  - Honor smb.conf socket options in winbind. (bsc#975131)

  - Fix ntlm-auth segmentation fault with squid.
    (bsc#986228)

  - Implement new '--no-dns-updates' option in 'net ads'     command. (bsc#991564)

  - Fix population of ctdb sysconfig after source merge.
    (bsc#981566)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A flaw was found in the way Samba initiated signed     DCE/RPC connections. A man-in-the-middle attacker could     use this flaw to downgrade the connection to not use     signing and therefore impersonate the server.
    (CVE-2016-2119)

Bug Fix(es) :

  - Previously, the 'net' command in some cases failed to     join the client to Active Directory (AD) because the     permissions setting prevented modification of the     supported Kerberos encryption type LDAP attribute. With     this update, Samba has been fixed to allow joining an AD     domain as a user. In addition, Samba now uses the     machine account credentials to set up the Kerberos     encryption types within AD for the joined machine. As a     result, using 'net' to join a domain now works more     reliably.

  - Previously, the idmap_hash module worked incorrectly     when it was used together with other modules. As a     consequence, user and group IDs were not mapped     properly. A patch has been applied to skip already     configured modules. Now, the hash module can be used as     the default idmap configuration back end and IDs are     resolved correctly.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1494 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * A flaw was found in the way Samba initiated signed DCE/RPC connections. A man-in-the-middle attacker     could use this flaw to downgrade the connection to not use signing and therefore impersonate the server.
    (CVE-2016-2119)

    Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Stefan     Metzmacher as the original reporter.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1637 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 9.6. It addresses 97 CVEs:
    CVE-2018-1050, CVE-2020-10760, CVE-2013-4475, CVE-2020-10730, CVE-2018-16857, and 92 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1613 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 9.2. It addresses 88 CVEs:
    CVE-2018-1050, CVE-2020-10760, CVE-2013-4475, CVE-2020-10730, CVE-2018-16857, and 83 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
92466	Samba 4.x < 4.2.14 / 4.3.x < 4.3.11 / 4.4.x < 4.4.5 SMB2/3 Client Connection Required Signing Downgrade	Nessus	Misc.	2016/7/20	2019/11/19	high
92579	RHEL 7 : samba (RHSA-2016:1486)	Nessus	Red Hat Local Security Checks	2016/7/27	2026/1/30	high
289199	MiracleLinux 4 : samba4-4.2.10-7.AXS4 (AXSA:2016-577:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
93702	openSUSE Security Update : samba (openSUSE-2016-1111)	Nessus	SuSE Local Security Checks	2016/9/26	2026/1/23	high
94274	SUSE SLES12 Security Update : samba (SUSE-SU-2016:2570-1)	Nessus	SuSE Local Security Checks	2016/10/26	2026/1/21	high
92582	Scientific Linux Security Update : samba on SL7.x x86_64 (20160726)	Nessus	Scientific Linux Local Security Checks	2016/7/27	2026/1/30	high
92603	RHEL 6 / 7 : samba (RHSA-2016:1494)	Nessus	Red Hat Local Security Checks	2016/7/28	2024/11/4	high
364609	Rocky Linux 9.6 [CIQ] Security Update: ldb-tools / libldb / libldb-devel / libnetapi / libnetapi-devel / etc Multiple Vulnerabilities (ciqsa-2026_1637)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/13	critical
364622	Rocky Linux 9.2 [CIQ] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (ciqsa-2026_1613)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/13	critical

検出

プラグインの検索

high

high

high

high

high

high

high

critical

critical