A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
结论预警: CVE-2016-2124 综合评估为中等风险（49.9/100）：CVSS 技术影响为中级，利用概率（EPSS 1.76%） 强制指令: 梳理受影响资产并纳入修补计划。
风险随态势动态变化；本站持续评估并同步更新本页展示内容。
EPSS 日更估计相对被利用可能性；百分位表示该 CVE 在已评分漏洞中的相对排名（越高表示相对更严重）。
| # | 日期 | 旧 EPSS 分数 | 新 EPSS 分数 | 变化（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-19 | 1.72% | 1.76% | +0.04% |
| 2 | 2026-06-15 | 0.70% | 1.72% | +1.02% |
| 3 | 2026-04-06 | — | 0.70% | — |
完整 EPSS 历史 （共 27 条）
该 CVE 的 CVSS 指标。
| 底座分 | 版本 | 严重度 | 向量 | 可利用性 | 影响 | 分数来源 |
|---|---|---|---|---|---|---|
| 5.9 | 3.1 | MEDIUM |
|
2.2 | 3.6 | [email protected] |
| 4.3 | 2.0 | MEDIUM |
|
8.6 | 2.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2016-2124: 1 source package rows (samba); 7 state rows across 7 repos (3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 7, open 0. | https://security.alpinelinux.org/vuln/CVE-2016-2124 |
debian
|
not yet assigned | CVE-2016-2124 not yet assigned priority: Debian including 1 source packages (samba), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2016-2124 |
gentoo
|
high | CVE-2016-2124: 1 GLSA(s) (202309-06), 1 atom(s) (net-fs/samba); latest impact high. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2016-2124 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2016-2124 |
suse
|
medium | CVE-2016-2124 severity moderate: SUSE including 1133 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 2898 product×package rows across 117 product lines (HPE Helion OpenStack 8, Image SLES12-SP5-Azure-BYOS, … (117 product lines)): Fixed 2712, Known Affected 160, Known Not Affected 26. | https://www.suse.com/security/cve/CVE-2016-2124/ |
ubuntu
|
medium | CVE-2016-2124 medium priority: Ubuntu including 1 source packages (samba), 15 status rows across 15 suites (bionic, focal, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): released 13, needed 2. | https://ubuntu.com/security/CVE-2016-2124 |
| 厂商 | 产品 | 版本 | 原始 CPE |
|---|---|---|---|
| samba | samba | >= 3.0.0, < 4.13.14 | cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* |
| samba | samba | >= 4.14.0, < 4.14.10 | cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* |
| samba | samba | >= 4.15.0, < 4.15.2 | cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* |
| debian | debian_linux | 9.0 | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| debian | debian_linux | 10.0 | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| fedoraproject | fedora | 33 | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| fedoraproject | fedora | 34 | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| fedoraproject | fedora | 35 | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder | — | cpe:2.3:a:redhat:codeready_linux_builder:-:*:*:*:*:*:*:* |
| redhat | gluster_storage | 3.0 | cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:* |
| redhat | gluster_storage | 3.5 | cpe:2.3:a:redhat:gluster_storage:3.5:*:*:*:*:*:*:* |
| redhat | openstack | 13 | cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* |
| redhat | openstack | 16.1 | cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:* |
| redhat | openstack | 16.2 | cpe:2.3:a:redhat:openstack:16.2:*:*:*:*:*:*:* |
| redhat | virtualization_host | 4.0 | cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 7.0 | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 8.0 | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop | 7.0 | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 8.2 | cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 8.4 | cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems | 7.0 | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0 | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.2 | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.4 | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_big_endian | 7.0 | cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian | 7.0 | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian | 8.0 | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.2 | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.4 | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_scientific_computing | 7.0 | cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_resilient_storage | 7.0 | cpe:2.3:o:redhat:enterprise_linux_resilient_storage:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server | 7.0 | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 8.2 | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 8.4 | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus | 8.4 | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 8.2 | cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 8.4 | cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_tus | 8.2 | cpe:2.3:o:redhat:enterprise_linux_tus:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation | 7.0 | cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 18.04 | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
| canonical | ubuntu_linux | 20.04 | cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* |
| canonical | ubuntu_linux | 21.04 | cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 21.10 | cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:* |
| URL | 标签 |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2019660 | Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html | |
| https://security.gentoo.org/glsa/202309-06 | |
| https://www.samba.org/samba/security/CVE-2016-2124.html | Mitigation Vendor Advisory |