CVE-2015-5296: Input Validation
As per upstream samba advisory:
Versions of Samba from 3.2.0 to 4.3.2 inclusive do not ensure that signing is negotiated when creating an encrypted client connection to a server.
Without this a man-in-the-middle attack could downgrade the connection and connect using the supplied credentials as an unsigned, unencrypted connection.
The following mitigation was suggested by upstream:
When using the smbclient command, always add the argument "--signing=required" when using the "-e" or "--encrypt" argument.
Alternatively, set the variable "client signing = mandatory" in the [global] section of the smb.conf file on any client using encrypted connections.
To protect a Samba server exporting encrypted shares against a downgrade attack set the variable "smb encrypt = mandatory" in the smb.conf definition of the encrypted shares.
Other sources
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmbserver.c, and smbXclibase.c.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5296?
CVE-2015-5296 is classified as a medium severity vulnerability due to potential man-in-the-middle attacks.
How do I fix CVE-2015-5296?
To fix CVE-2015-5296, upgrade Samba to version 4.1.22 or later, 4.2.7 or later, or 4.3.3 or later.
What versions of Samba are affected by CVE-2015-5296?
Samba versions from 3.2.0 to 4.3.2 inclusive are affected by CVE-2015-5296.
What kind of attack does CVE-2015-5296 allow?
CVE-2015-5296 allows a man-in-the-middle attack due to improper signing negotiation during encrypted connections.
Is there any workaround for CVE-2015-5296?
The primary recommendation is to update to the patched versions; there are no reliable workarounds for CVE-2015-5296.