smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support is enabled, runs with the CAP_DAC_OVERRIDE capability, which allows remote authenticated users to bypass intended file permissions via standard filesystem operations with any client.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has samba packages installed that are affected by multiple vulnerabilities:

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

  - Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows     local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors     that cause the daemon to transition to the root user. (CVE-2007-2444)

  - Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files,     which allows local users to modify the membership of Unix groups. (CVE-2008-3789)

  - smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a     denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a cut&paste     error that causes an improper bounds check to be performed. (CVE-2008-4314)

  - smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support is enabled, runs with the CAP_DAC_OVERRIDE     capability, which allows remote authenticated users to bypass intended file permissions via standard     filesystem operations with any client. (CVE-2010-0728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has samba packages installed that are affected by multiple vulnerabilities:

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

  - Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows     local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors     that cause the daemon to transition to the root user. (CVE-2007-2444)

  - Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files,     which allows local users to modify the membership of Unix groups. (CVE-2008-3789)

  - smbd in Samba 3.0.29 through 3.2.4 might allow remote attackers to read arbitrary memory and cause a     denial of service via crafted (1) trans, (2) trans2, and (3) nttrans requests, related to a cut&paste     error that causes an improper bounds check to be performed. (CVE-2008-4314)

  - smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support is enabled, runs with the CAP_DAC_OVERRIDE     capability, which allows remote authenticated users to bypass intended file permissions via standard     filesystem operations with any client. (CVE-2010-0728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201206-22 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with root       privileges, cause a Denial of Service condition, take ownership of shared       files, or bypass file permissions. Furthermore, a local attacker may be       able to cause a Denial of Service condition or obtain sensitive       information in a Samba credentials file.
  Workaround :

    There is no known workaround at this time.

The remote Samba server has a flaw that causes all smbd processes, when libcap support is enabled, to inherit 'CAP_DAC_OVERRIDE' capabilities, which in turn causes all file system access to be allowed even when permissions should have been denied.

A remote, authenticated attacker can exploit this flaw to gain access to sensitive information on Samba shares that are accessible to their user id.

The remote Samba server is potentially affected by a security bypass vulnerability because of a flaw that causes all smbd processes, when libcap support is enabled, to inherit 'CAP_DAC_OVERRIDE' capabilities, which in turn causes all file system access to be allowed even when permissions should have been denied.

A remote, authenticated attacker may be able to exploit this flaw to gain access to sensitive information on Samba shares that are accessible to their user id.

According to its banner, the version of Samba Server on the remote host is potentially affected by a security bypass vulnerability.  A flaw exists that causes all smbd processes to inherit CAP_DAC_OVERRIDE capabilities, allowing all file system access to be allowed even when permissions should have denied access.

ID	Name	Product	Family	Severity
301208	NewStart CGSL MAIN 6.06 (SP) : samba Multiple Vulnerabilities (NS-SA-2026-0007)	Nessus	NewStart CGSL Local Security Checks	high
266281	NewStart CGSL MAIN 6.06 : samba Multiple Vulnerabilities (NS-SA-2025-0208)	Nessus	NewStart CGSL Local Security Checks	high
59675	GLSA-201206-22 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
45047	Samba 'CAP_DAC_OVERRIDE' File Permission Security Bypass	Nessus	Misc.	high
45046	Samba 'CAP_DAC_OVERRIDE' File Permission Security Bypass (version check)	Nessus	Misc.	high
5360	Samba 3.3.11 / 3.4.6 / 3.5.0 Security Bypass Vulnerability	Nessus Network Monitor	Samba	high

Detections

Analytics

CVE-2010-0728

medium

Tenable Plugins

high

high

critical

high

high

high