CVE-2017-12151CWE-300

A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3

High · published July 27, 2018

CVSS v3.0
7.4
EPSS
4%
Percentile
90.7
In the wild
Unconfirmed
What it is

A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.04104 · 90.7th percentile
Weakness
CWE-300 · Channel Accessible by Non-Endpoint
Published
2018-07-27T12:00Z
EPSS history
Timeline
  • 27 JUL 12:00Z
    A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3
    cvelistv5