diff --git a/CHANGELOG b/CHANGELOG
index d485a4fab..22e789239 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,10 @@ o [NSE][GH#1720] Functions lsa_lookupnames2 and lsa_lookupsids2 in library
   msrpc were incorrectly referencing function strjoin when called with debug
   level 2 or higher. [Ivan Ivanov]
 
+o [NSE][GH#1476][GH#1707] A MS-SMB spec non-compliance in Samba was causing
+  protocol negotiation to fail with data string too short error.
+  [Clément Notin, nnposter]
+
 o [NSE][GH#1480][GH#1713][GH#1714] A bug in SMB library was causing scripts to
   fail with bad format argument error. [Ivan Ivanov]
 
diff --git a/nselib/smb.lua b/nselib/smb.lua
index 174245d83..9d3fb1129 100644
--- a/nselib/smb.lua
+++ b/nselib/smb.lua
@@ -1020,15 +1020,11 @@ function negotiate_v1(smb, overrides)
   end
 
   -- Data section
-  if #data < smb.key_length then
-    return false, "SMB: ERROR: not enough data for server_challenge"
-  end
-  smb.server_challenge, pos = string.unpack(string.format("<c%d", smb['key_length']), data)
   if(smb['extended_security'] == true) then
     if #data < 16 then
       return false, "SMB: ERROR: not enough data for extended security"
     end
-    smb.server_guid, pos = string.unpack("<c16", data, pos)
+    smb.server_guid, pos = string.unpack("<c16", data)
 
     -- do we have a security blob?
     if ( #data - pos + 1 > 0 ) then
@@ -1036,6 +1032,11 @@ function negotiate_v1(smb, overrides)
       pos = #data + 1
     end
   else
+    if #data < smb.key_length then
+      return false, "SMB: ERROR: not enough data for server_challenge"
+    end
+    smb.server_challenge, pos = string.unpack(string.format("<c%d", smb['key_length']), data)
+
     -- Get the (null-terminated) domain as a Unicode string
     smb['domain'] = ""
     smb['server'] = ""