Samba 3.x and 4.x before 4.1.22 4.2.x before 4.2.7 and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream related to clidfs.c libsmb_server.c and smbXcli_base.c.