Описание
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 2:4.3.3+dfsg-1ubuntu1 |
| esm-infra-legacy/trusty | released | 2:4.1.6+dfsg-1ubuntu2.14.04.11 |
| esm-infra/xenial | released | 2:4.3.3+dfsg-1ubuntu1 |
| precise | released | 2:3.6.3-2ubuntu2.13 |
| precise/esm | not-affected | 2:3.6.3-2ubuntu2.13 |
| trusty | released | 2:4.1.6+dfsg-1ubuntu2.14.04.11 |
| trusty/esm | released | 2:4.1.6+dfsg-1ubuntu2.14.04.11 |
| upstream | released | 4.3.3,4.2.7,4.1.22 |
| vivid | released | 2:4.1.13+dfsg-4ubuntu3.1 |
| vivid/stable-phone-overlay | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-infra-legacy/trusty | DNE | |
| precise | ignored | end of life |
| precise/esm | DNE | precise was needed |
| trusty | DNE | |
| trusty/esm | DNE | |
| upstream | released | 4.3.3,4.2.7,4.1.22 |
| vivid | DNE | |
| vivid/stable-phone-overlay | DNE | |
| vivid/ubuntu-core | DNE |
Показывать по
EPSS
4.3 Medium
CVSS2
5.4 Medium
CVSS3
Связанные уязвимости
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before ...
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
Уязвимость компонента clidfs.c, libsmb_server.c и smbXcli_base.c пакета программ сетевого взаимодействия Samba, связанная с недостатком механизма проверки вводимых данных, позволяющая нарушителю оказать воздействие на целостность данных
EPSS
4.3 Medium
CVSS2
5.4 Medium
CVSS3