CVE-2017-12151
High
Description
A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.
SeverityHigh
CVSS7.4
Exploit probability—
Product
Samba
PublishedJul 27, 2018
First seenJul 27, 2018
Weakness typeCWE-300CWE-300
How to fix
Update
- samba samba4.4.16, 4.5.14, 4.6.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba samba | v < 4.4.16, 4.5.0 ≤ v < 4.5.14, 4.6.0 ≤ v < 4.6.8 | 4.4.16, 4.5.14, 4.6.8 |
| debian debian_linux | 8.0, 9.0 | — |
| redhat enterprise_linux | 7.0 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_server_aus | 7.4 | — |
| redhat enterprise_linux_server_eus | 7.4, 7.5 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| hp cifs_server | b.04.05.11.00 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.