SMB/CIFS (file sharing, Windows environment)
I understand when a client connects to a server there is a challenge/response system in place. However, once the client is connected that "connection" is authenticated. At this point, couldn't a man-in-the-middle(like) [or rather a network level] attack spoofing the connected session's IP and port submit arbitrary commands.
Does the server consider the "IP:port" authenticated, or is there more to it?