CVE-2016-2124

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure the following [global] smb.conf parameters are set to their default values as shown below:

  client lanman auth = no
  client NTLMv2 auth = yes
  client plaintext auth = no
  client min protocol = SMB2_02

Or use the '-k' command line option only without the -U option, which will make use of an existing krb5 ccache.