It was found that Samba based active directory domain controller does not enforce smb signing and opens possibility for man-in-the-middle attacks. When Samba is configured as a Domain Controller, the default for the "server signing" should be "mandatory". During the early development of Samba 4 a new experimental file server located under source4/smb_server was used. But before the final 4.0.0 release upstream switched back to the file server under source3/smbd. But the logic for the correct default of "server signing" was not ported. Currently all Samba versions >= 4.0.0 are affected. Upstream bug: https://bugzilla.samba.org/show_bug.cgi?id=11687
Acknowledgements: Name: the Samba project Upstream: Stefan Metzmacher (SerNet)
External Reference: https://access.redhat.com/articles/2243351
Public via: https://www.samba.org/samba/security/CVE-2016-2114.html
Created samba tracking bugs for this issue: Affects: fedora-all [bug 1326453]
This issue has been addressed in the following products: Red Hat Enterprise Linux 6.6 Extended Update Support Red Hat Enterprise Linux 6.5 Advanced Update Support Red Hat Enterprise Linux 6.4 Advanced Update Support Red Hat Enterprise Linux 6.2 Advanced Update Support Via RHSA-2016:0620 https://rhn.redhat.com/errata/RHSA-2016-0620.html
This issue has been addressed in the following products: Red Hat Gluster Storage 3.1 for RHEL 7 Red Hat Gluster Storage 3.1 for RHEL 6 Via RHSA-2016:0614 https://rhn.redhat.com/errata/RHSA-2016-0614.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2016:0612 https://rhn.redhat.com/errata/RHSA-2016-0612.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.1 Extended Update Support Via RHSA-2016:0618 https://rhn.redhat.com/errata/RHSA-2016-0618.html
samba-4.3.8-0.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
samba-4.2.11-0.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
samba-4.4.2-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.