Samba 4.15.2, 4.14.10, 4.13.14 security releases apply to AD domain scenerios only

Firstly, sorry for missing the CVSS score on CVE-2016-2124. My stab at this is:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (5.3)

(CVSS scores are meant to assume the worst case)

It isn't ideal that it is possible to disclose the NTLMv2 response, due to 'pass the hash' attacks, but by default the plaintext password isn't shown unless other configuration options were set (client plaintext auth). That would make it a 3.1 if you consider an NTLMv2 response a 'limited breach of confidentiality'.

More broadly, there are a few concerns for Samba clients in Windows domains. It depends on what kind of client and what level of trust there is in the DC, but we issued CVE-2020-25717 because the controls around msDS-MachineAccountQuota were way to weak (and Samba was not strict enough about sandboxing AD accounts to an AD-specific namespace).

My personal view is that CVE-2021-23192 was important to fix but it is a server-side issue and assumes a MITM already and a request with multiple fragments (which is rare, and quite unlikely outside the context of being the DC).