NetSight
IP …
medium5.4

CVE-2015-5296

Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middl…

Impact

Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.

Affected products

VendorProductAffected versions
SambaSamba
from 3.2.0 before 4.1.22
from 4.2.0 before 4.2.7
from 4.3.0 before 4.3.3
DebianDebian Linux
Versions 7.0, 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04, 15.10

Weakness classification

CWE-20

References