Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1290292 - (CVE-2015-5296) CVE-2015-5296 samba: client requesting encryption vulnerable to downgrade attack
CVE-2015-5296 samba: client requesting encryption vulnerable to downgrade attack
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20151216,repor...
: Security
Depends On: 1290706 1290707 1290708 1290709 1290710 1290711 1290727 1292069
Blocks: 1281327
  Show dependency tree / graph
 
Reported: 2015-12-10 00:29 EST by Huzaifa S. Sidhpurwala
Modified: 2016-01-11 03:55 EST (History)
15 users (show)

See Also:
Fixed In Version: samba 4.1.22, samba 4.2.7, samba 4.3.3
Doc Type: Bug Fix
Doc Text:
A man-in-the-middle vulnerability was found in the way "connection signing" was implemented by Samba. A remote attacker could use this flaw to downgrade an existing Samba client connection and force the use of plain text.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-01-08 07:19:30 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0006 normal SHIPPED_LIVE Moderate: samba security update 2016-01-08 01:39:15 EST
Red Hat Product Errata RHSA-2016:0010 normal SHIPPED_LIVE Moderate: samba4 security update 2016-01-07 22:43:17 EST
Red Hat Product Errata RHSA-2016:0011 normal SHIPPED_LIVE Moderate: samba security update 2016-01-07 17:20:52 EST
Red Hat Product Errata RHSA-2016:0015 normal SHIPPED_LIVE Moderate: samba security update 2016-01-08 10:18:26 EST
Red Hat Product Errata RHSA-2016:0016 normal SHIPPED_LIVE Moderate: samba security update 2016-01-08 10:17:52 EST

  None (edit)
Description Huzaifa S. Sidhpurwala 2015-12-10 00:29:52 EST 
As per upstream samba advisory:

Versions of Samba from 3.2.0 to 4.3.2 inclusive do not ensure that signing is negotiated when creating an encrypted client connection to
a server.

Without this a man-in-the-middle attack could downgrade the connection and connect using the supplied credentials as an unsigned, unencrypted
connection.

The following mitigation was suggested by upstream:


When using the smbclient command, always add the argument "--signing=required" when using the "-e" or "--encrypt" argument.

Alternatively, set the variable "client signing = mandatory" in the [global] section of the smb.conf file on any client using encrypted connections.

To protect a Samba server exporting encrypted shares against a downgrade attack set the variable "smb encrypt = mandatory" in the smb.conf definition of the encrypted shares.
Comment 1 Huzaifa S. Sidhpurwala 2015-12-10 01:34:11 EST 
Acknowledgements:

Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Stefan Metzmacher of the Samba Team and Sernet.de as the original reporters.
Comment 5 Siddharth Sharma 2015-12-16 07:09:14 EST 
Created samba tracking bugs for this issue:

Affects: fedora-all [bug 1292069]
Comment 6 Huzaifa S. Sidhpurwala 2015-12-16 23:12:27 EST 
External References:

https://www.samba.org/samba/security/CVE-2015-5296.html
Comment 8 errata-xmlrpc 2016-01-07 12:07:00 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0010 https://rhn.redhat.com/errata/RHSA-2016-0010.html
Comment 9 errata-xmlrpc 2016-01-07 12:23:21 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0011 https://rhn.redhat.com/errata/RHSA-2016-0011.html
Comment 10 errata-xmlrpc 2016-01-07 20:40:31 EST 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:0006 https://rhn.redhat.com/errata/RHSA-2016-0006.html
Comment 11 errata-xmlrpc 2016-01-08 05:19:12 EST 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 7

Via RHSA-2016:0016 https://rhn.redhat.com/errata/RHSA-2016-0016.html
Comment 12 errata-xmlrpc 2016-01-08 05:19:56 EST 
This issue has been addressed in the following products:

  Red Hat Gluster Storage 3.1 for RHEL 6

Via RHSA-2016:0015 https://rhn.redhat.com/errata/RHSA-2016-0015.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.