CVE-2016-2118: samba:SAMR and LSA man in the middle attacks possible (aka "BADLOCK")

SLES 12 SP1

Released on the 12th of April 2016:
 libdcerpc-binding0-32bit-4.2.4-16.1
 libdcerpc-binding0-4.2.4-16.1
 libdcerpc0-32bit-4.2.4-16.1
 libdcerpc0-4.2.4-16.1
 libgensec0-32bit-4.2.4-16.1
 libgensec0-4.2.4-16.1
 libndr-krb5pac0-32bit-4.2.4-16.1
 libndr-krb5pac0-4.2.4-16.1
 libndr-nbt0-32bit-4.2.4-16.1
 libndr-nbt0-4.2.4-16.1
 libndr-standard0-32bit-4.2.4-16.1
 libndr-standard0-4.2.4-16.1
 libndr0-32bit-4.2.4-16.1
 libndr0-4.2.4-16.1
 libnetapi0-32bit-4.2.4-16.1
 libnetapi0-4.2.4-16.1
 libregistry0-4.2.4-16.1
 libsamba-credentials0-32bit-4.2.4-16.1
 libsamba-credentials0-4.2.4-16.1
 libsamba-hostconfig0-32bit-4.2.4-16.1
 libsamba-hostconfig0-4.2.4-16.1
 libsamba-passdb0-32bit-4.2.4-16.1
 libsamba-passdb0-4.2.4-16.1
 libsamba-util0-32bit-4.2.4-16.1
 libsamba-util0-4.2.4-16.1
 libsamdb0-32bit-4.2.4-16.1
 libsamdb0-4.2.4-16.1
 libsmbclient-raw0-32bit-4.2.4-16.1
 libsmbclient-raw0-4.2.4-16.1
 libsmbclient0-32bit-4.2.4-16.1
 libsmbclient0-4.2.4-16.1
 libsmbconf0-32bit-4.2.4-16.1
 libsmbconf0-4.2.4-16.1
 libsmbldap0-32bit-4.2.4-16.1
 libsmbldap0-4.2.4-16.1
 libtevent-util0-32bit-4.2.4-16.1
 libtevent-util0-4.2.4-16.1
 libwbclient0-32bit-4.2.4-16.1
 libwbclient0-4.2.4-16.1
 samba-32bit-4.2.4-16.1
 samba-4.2.4-16.1
 samba-client-32bit-4.2.4-16.1
 samba-client-4.2.4-16.1
 samba-debugsource-4.2.4-16.1
 samba-doc-4.2.4-16.1
 samba-libs-32bit-4.2.4-16.1
 samba-libs-4.2.4-16.1
 samba-winbind-32bit-4.2.4-16.1
 samba-winbind-4.2.4-16.1

SLES 12

Released on the 12th of April 2016:
 libdcerpc-binding0-32bit-4.2.4-18.17.1
 libdcerpc-binding0-4.2.4-18.17.1
 libdcerpc0-32bit-4.2.4-18.17.1
 libdcerpc0-4.2.4-18.17.1
 libgensec0-32bit-4.2.4-18.17.1
 libgensec0-4.2.4-18.17.1
 libndr-krb5pac0-32bit-4.2.4-18.17.1
 libndr-krb5pac0-4.2.4-18.17.1
 libndr-nbt0-32bit-4.2.4-18.17.1
 libndr-nbt0-4.2.4-18.17.1
 libndr-standard0-32bit-4.2.4-18.17.1
 libndr-standard0-4.2.4-18.17.1
 libndr0-32bit-4.2.4-18.17.1
 libndr0-4.2.4-18.17.1
 libnetapi0-32bit-4.2.4-18.17.1
 libnetapi0-4.2.4-18.17.1
 libregistry0-4.2.4-18.17.1
 libsamba-credentials0-32bit-4.2.4-18.17.1
 libsamba-credentials0-4.2.4-18.17.1
 libsamba-hostconfig0-32bit-4.2.4-18.17.1
 libsamba-hostconfig0-4.2.4-18.17.1
 libsamba-passdb0-32bit-4.2.4-18.17.1
 libsamba-passdb0-4.2.4-18.17.1
 libsamba-util0-32bit-4.2.4-18.17.1
 libsamba-util0-4.2.4-18.17.1
 libsamdb0-32bit-4.2.4-18.17.1
 libsamdb0-4.2.4-18.17.1
 libsmbclient-raw0-32bit-4.2.4-18.17.1
 libsmbclient-raw0-4.2.4-18.17.1
 libsmbclient0-32bit-4.2.4-18.17.1
 libsmbclient0-4.2.4-18.17.1
 libsmbconf0-32bit-4.2.4-18.17.1
 libsmbconf0-4.2.4-18.17.1
 libsmbldap0-32bit-4.2.4-18.17.1
 libsmbldap0-4.2.4-18.17.1
 libtevent-util0-32bit-4.2.4-18.17.1
 libtevent-util0-4.2.4-18.17.1
 libwbclient0-32bit-4.2.4-18.17.1
 libwbclient0-4.2.4-18.17.1
 samba-32bit-4.2.4-18.17.1
 samba-4.2.4-18.17.1
 samba-client-32bit-4.2.4-18.17.1
 samba-client-4.2.4-18.17.1
 samba-debugsource-4.2.4-18.17.1
 samba-doc-4.2.4-18.17.1
 samba-libs-32bit-4.2.4-18.17.1
 samba-libs-4.2.4-18.17.1
 samba-winbind-32bit-4.2.4-18.17.1
 samba-winbind-4.2.4-18.17.1

SLES 11 SP4 & SLES 11 SP3 LTSS

Released on the 12th of April 2016:
 ldapsmb-1.34b-76.1
 libldb1-3.6.3-76.1
 libsmbclient0-3.6.3-76.1
 libsmbclient0-32bit-3.6.3-76.1
 libtalloc2-3.6.3-76.1
 libtalloc2-32bit-3.6.3-76.1
 libtdb1-3.6.3-76.1
 libtdb1-32bit-3.6.3-76.1
 libtevent0-3.6.3-76.1
 libtevent0-32bit-3.6.3-76.1
 libwbclient0-3.6.3-76.1
 libwbclient0-32bit-3.6.3-76.1
 samba-3.6.3-76.1.src.rpm
 samba-3.6.3-76.1
 samba-32bit-3.6.3-76.1
 samba-client-3.6.3-76.1
 samba-client-32bit-3.6.3-76.1
 samba-doc-3.6.3-76.2
 samba-krb-printing-3.6.3-76.1
 samba-winbind-3.6.3-76.1
 samba-winbind-32bit-3.6.3-76.1

SLES 11 SP2 LTSS

Released on the 13th of April 2016:
 ldapsmb-1.34b-52.1
 libldb1-3.6.3-52.1
 libsmbclient0-3.6.3-52.1
 libsmbclient0-32bit-3.6.3-52.1
 libtalloc2-3.6.3-52.1
 libtalloc2-32bit-3.6.3-52.1
 libtdb1-3.6.3-52.1
 libtdb1-32bit-3.6.3-52.1
 libtevent0-3.6.3-52.1
 libtevent0-32bit-3.6.3-52.1
 libwbclient0-3.6.3-52.1
 libwbclient0-32bit-3.6.3-52.1
 samba-3.6.3-52.1.src.rpm
 samba-3.6.3-52.1
 samba-32bit-3.6.3-52.1
 samba-client-3.6.3-52.1
 samba-client-32bit-3.6.3-52.1
 samba-doc-3.6.3-52.1
 samba-krb-printing-3.6.3-52.1
 samba-winbind-3.6.3-52.1
 samba-winbind-32bit-3.6.3-52.1

Expanded Support 4 (RES4)

• Patches have been released on the 14th of April 2016
  
• Samba 3.0.33
  

Expanded Support 5 (RES5)

• Patches have been released on the 14th of April 2016
• Samba 3.0.33
  

Expanded Support 6 (RES6)

• Patches have been released on the 14th of April 2016
• Samba 3.6.23
  

Expanded Support 7 (RES7)

• Patches have been released on the 14th of April 2016
• Samba 4.2.3
  

• Man in the middle (MITM) attacks

There are several MITM attacks that can be performed against a variety of protocols used by Samba. These would permit execution of arbitrarySamba network calls using the context of the intercepted user.
Impact example of intercepting administrator network traffic:
* Samba file server - modify user permissions on files or directories.

To execute a man in the middle attack requires an attacker to manipulate network traffic in the local network segment of the client or server.

Mitigations:
etwork protections that could be used MITM attacks include DHCPsnooping, ARP Inspection and 802.1x.
Suggested further improvements after patching:
It is recomended that administrators set these additional options, if compatible with their network environment:

• server signing = required
• ntlm auth = no
  

Without server signing = required, Man in the Middle attacks are still possible against our file server and Domain controller.
Without 'ntlm auth = no', there may still be clients not using NTLMv2, and these observed passwords may be brute-forced easilyusing cloud-computing resources or rainbow tables.

• Denial of Service (DoS)

Samba services are vulnerable to a denial of service from an attackerwith remote network connectivity to the Samba service.

Mitigation:
Apply firewall rules on the server to permit connectivity only from trusted addresses.

Will encryption protect against these attacks?
The SMB protocol, by default, only encrypts credentials and commandswhile files are transferred in plaintext. It is recommended that insecurity / privacy sensitive scenarios encryption is used to protectall communications.
Samba added encryption in version 3.2 in 2008 but only to Samba clients. Microsoft added SMB encryption support to SMB 3.0 in Windows 8 and Windows Server 2012. However, both of these types of encryptiononly protect communications, such a file transfers, after SMB negotiation and commands have been completed. It is this phase thatcontains the fixed vulnerabilities.
Samba/SMB encryption is good practice but is not sufficient for protection against these vulnerabilities. Network-level encryption, such as IPSec, is required for full protection as a workaround.