Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups.

The remote NewStart CGSL host, running version MAIN 6.06, has samba packages installed that are affected by multiple vulnerabilities:

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

  - Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows     local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors     that cause the daemon to transition to the root user. (CVE-2007-2444)

  - Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files,     which allows local users to modify the membership of Unix groups. (CVE-2008-3789)

  - smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a     denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a cut&paste     error that causes an improper bounds check to be performed. (CVE-2008-4314)

  - smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support is enabled, runs with the CAP_DAC_OVERRIDE     capability, which allows remote authenticated users to bypass intended file permissions via standard     filesystem operations with any client. (CVE-2010-0728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Samba running on the remote host is prior to 3.2.3. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain privileged or administrator access to the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This is an update to version 3.2.3 of Samba.

This release includes several bugfixes and performance enhancements for Samba and its components. It is recommended for every user to update to this version.

Among several other bugs the following list shows some detail :

  - Fix a race condition in winbind leading to a crash     (bnc#406623).

  - Fix emptying the printing queue; (bnc#411493).

  - Fix the webinface SWAT; (bnc#391969).

  - Fixed a file permission problem. (CVE-2008-3789)     bnc#420634

Security fix for CVE-2008-3789 detailed in the upstream advisory:
http://www.samba.org/samba/security/CVE-2008-3789.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
266281	NewStart CGSL MAIN 6.06 : samba Multiple Vulnerabilities (NS-SA-2025-0208)	Nessus	NewStart CGSL Local Security Checks	high
122057	Samba 3.2.x < 3.2.3 Privilege Escalation Vulnerability	Nessus	Misc.	critical
40126	openSUSE Security Update : samba (samba-174)	Nessus	SuSE Local Security Checks	low
34100	Fedora 9 : samba-3.2.3-0.20.fc9 (2008-7243)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2008-3789

high

Tenable Plugins

high

critical

low

low