CVE-2015-5296

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174076.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174391.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00019.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00020.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00033.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00017.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00047.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00048.html

http://www.debian.org/security/2016/dsa-3433

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.securityfocus.com/bid/79732

http://www.securitytracker.com/id/1034493

http://www.ubuntu.com/usn/USN-2855-1

http://www.ubuntu.com/usn/USN-2855-2

https://bugzilla.redhat.com/show_bug.cgi?id=1290292

https://git.samba.org/?p=samba.git;a=commit;h=1ba49b8f389eda3414b14410c7fbcb4041ca06b1

https://git.samba.org/?p=samba.git;a=commit;h=a819d2b440aafa3138d95ff6e8b824da885a70e9

https://git.samba.org/?p=samba.git;a=commit;h=d724f835acb9f4886c0001af32cd325dbbf1f895

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993

https://security.gentoo.org/glsa/201612-47

https://www.samba.org/samba/security/CVE-2015-5296.html

Details

Source: MITRE

Published: 2015-12-29

Updated: 2018-10-30

Type: CWE-20

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3

Base Score: 5.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Impact Score: 2.7

Exploitability Score: 2.2

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:samba:samba:3.0.2a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.4:rc1:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:b:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:c:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:pre1:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:pre2:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:rc1:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:rc2:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25:rc3:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25b:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.25c:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.26:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.26:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.26a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.27:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.27:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.27a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.28:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.28:a:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.28a:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.29:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.30:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.31:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.32:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.33:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.34:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.35:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.36:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.0.37:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.1.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.14:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.2.15:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:3.3.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.14:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.15:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.16:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.17:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.18:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.19:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.20:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.21:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.22:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.23:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.0.24:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.7:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.8:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.9:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.10:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.11:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.12:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.13:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.14:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.15:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.16:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.17:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.18:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.19:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.20:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.1.21:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.2.6:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.3.1:*:*:*:*:*:*:*

cpe:2.3:a:samba:samba:4.3.2:*:*:*:*:*:*:*

Tenable Plugins

View all (35 total)

IDNameProductFamilySeverity
96127GLSA-201612-47 : Samba: Multiple vulnerabilities (Badlock)NessusGentoo Local Security Checks
high
9347Samba 4.2.x < 4.2.7 / 4.3.x < 4.3.3 Multiple VulnerabilitiesNessus Network MonitorSamba
medium
9346Samba 4.x < 4.1.22 Multiple VulnerabilitiesNessus Network MonitorSamba
medium
90609openSUSE Security Update : samba (openSUSE-2016-490) (Badlock)NessusSuSE Local Security Checks
high
90558openSUSE Security Update : samba (openSUSE-2016-462) (Badlock)NessusSuSE Local Security Checks
high
90077RHEL 6 : Storage Server (RHSA-2016:0015)NessusRed Hat Local Security Checks
high
89376Fedora 23 : samba-4.3.3-0.fc23 (2015-b36076d32e)NessusFedora Local Security Checks
high
89144Fedora 22 : samba-4.2.7-0.fc22 (2015-0e0879cc8a)NessusFedora Local Security Checks
high
88804Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : samba regression (USN-2855-2)NessusUbuntu Local Security Checks
high
88005SUSE SLED11 / SLES11 Security Update : samba (SUSE-SU-2016:0164-1)NessusSuSE Local Security Checks
high
87968Amazon Linux AMI : samba (ALAS-2016-634)NessusAmazon Linux Local Security Checks
high
87863SUSE SLES11 Security Update : samba (SUSE-SU-2016:0032-1)NessusSuSE Local Security Checks
high
87856RHEL 7 : Storage Server (RHSA-2016:0016)NessusRed Hat Local Security Checks
high
87844Scientific Linux Security Update : samba on SL7.x x86_64 (20160107)NessusScientific Linux Local Security Checks
high
87843Scientific Linux Security Update : samba on SL6.x i386/x86_64 (20160107)NessusScientific Linux Local Security Checks
high
87842Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20160107)NessusScientific Linux Local Security Checks
high
87811RHEL 6 : samba (RHSA-2016:0011)NessusRed Hat Local Security Checks
high
87810RHEL 6 : samba4 (RHSA-2016:0010)NessusRed Hat Local Security Checks
high
87806RHEL 7 : samba (RHSA-2016:0006)NessusRed Hat Local Security Checks
high
87798Oracle Linux 6 : samba (ELSA-2016-0011)NessusOracle Linux Local Security Checks
high
87797Oracle Linux 6 : samba4 (ELSA-2016-0010)NessusOracle Linux Local Security Checks
high
87793Oracle Linux 7 : samba (ELSA-2016-0006)NessusOracle Linux Local Security Checks
high
87784CentOS 6 : samba (CESA-2016:0011)NessusCentOS Local Security Checks
high
87783CentOS 6 : samba4 (CESA-2016:0010)NessusCentOS Local Security Checks
high
87779CentOS 7 : samba (CESA-2016:0006)NessusCentOS Local Security Checks
high
87769Samba 4.2.x < 4.2.7 / 4.3.x < 4.3.3 Multiple VulnerabilitiesNessusMisc.
high
87768Samba 4.x < 4.1.22 Multiple VulnerabilitiesNessusMisc.
high
87755Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : samba vulnerabilities (USN-2855-1)NessusUbuntu Local Security Checks
high
87684Debian DSA-3433-1 : samba - security updateNessusDebian Local Security Checks
high
87683Debian DLA-379-1 : samba security updateNessusDebian Local Security Checks
high
87622openSUSE Security Update : samba / ldb / talloc / etc (openSUSE-2015-945)NessusSuSE Local Security Checks
high
87621openSUSE Security Update : ldb / samba / talloc / etc (openSUSE-2015-943)NessusSuSE Local Security Checks
high
87527SUSE SLED12 / SLES12 Security Update : ldb, samba, talloc, tdb, tevent (SUSE-SU-2015:2305-1)NessusSuSE Local Security Checks
high
87526SUSE SLED12 / SLES12 Security Update : ldb, samba, talloc, tdb, tevent (SUSE-SU-2015:2304-1)NessusSuSE Local Security Checks
high
87514FreeBSD : samba -- multiple vulnerabilities (ef434839-a6a4-11e5-8275-000c292e4fd8)NessusFreeBSD Local Security Checks
high