The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.

This update fixes these security vulnerabilities :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2114: 'server signing = mandatory' not enforced     (bsc#973035).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

The openSUSE 13.1 update also upgrades to samba 4.2.4 as 4.1.x versions are no longer supported by upstream. As a side effect, libpdb0 package was replaced by libsamba-passdb0.

This is a LTSS roll-up update for the Samba Server suite fixing multiple security issues and bugs.

Security issues fixed :

  - CVE-2013-4496: Password lockout was not enforced for     SAMR password changes, leading to brute force     possibility.

  - CVE-2013-4408: DCE-RPC fragment length field is     incorrectly checked.

  - CVE-2013-4124: Samba was affected by a denial of service     attack on authenticated or guest connections.

  - CVE-2013-0214: The SWAT webadministration was affected     by a cross site scripting attack (XSS).

  - CVE-2013-0213: The SWAT webadministration could possibly     be used in clickjacking attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201502-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, bypass intended file restrictions,       or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - The winbind_name_list_to_sid_string_list function in     nsswitch/pam_winbind.c in Samba through 4.1.2 handles     invalid require_membership_of group names by accepting     authentication by any user, which allows remote     authenticated users to bypass intended access     restrictions in opportunistic circumstances by     leveraging an administrator's pam_winbind     configuration-file mistake. (CVE-2012-6150)

  - Heap-based buffer overflow in the     dcerpc_read_ncacn_packet_done function in     librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before     3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3     allows remote AD domain controllers to execute arbitrary     code via an invalid fragment length in a DCE-RPC packet.
    (CVE-2013-4408)

Update to Samba 4.0.21. CVE-2014-3560.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.1.9. Update to Samba 4.1.8 (CVE-2014-0178 samba:
Uninitialized memory exposure)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Samba was updated to fix security issues and bugs :

Security issues fixed :

  - Password lockout was not enforced for SAMR password     changes, this allowed brute-force attacks on passwords.
    CVE-2013-4496; (bnc#849224).

  - The DCE-RPC fragment length field is incorrectly     checked, which could expose samba clients to buffer     overflow exploits caused by malicious servers;
    CVE-2013-4408; (bnc#844720).

  - The pam_winbind login without require_membership_of     restrictions could allow fallbacks to local users even     if they were not intended to be allowed; CVE-2012-6150;
    (bnc#853347).

Also non security bugs were fixed :

  - Fix problem with server taking too long to respond to a     MSG_PRINTER_DRVUPGRADE message; (bso#9942);
    (bnc#863748).

  - Fix memory leak in printer_list_get_printer();
    (bso#9993); (bnc#865561).

  - Depend on %version-%release with all manual Provides and     Requires; (bnc#844307).

  - Remove superfluous obsoletes *-64bit in the ifarch ppc64     case; (bnc#437293).

  - Fix Winbind 100% CPU utilization caused by domain list     corruption; (bso#10358); (bnc#786677).

  - Samba is chatty about being unable to open a printer;
    (bso#10118).

  - nsswitch: Fix short writes in winbind_write_sock;
    (bso#10195).

  - xattr: fix listing EAs on *BSD for non-root users;
    (bso#10247).

  - spoolss: accept XPS_PASS datatype used by Windows 8;
    (bso#10267).

  - The preceding bugs are tracked by (bnc#854520) too.

  - Make use of the full gpg pub key file name including the     key ID.

  - Remove bogus libsmbclient0 package description and     cleanup the libsmbclient line from baselibs.conf;
    (bnc#853021).

  - Allow smbcacls to take a '--propagate-inheritance' flag     to indicate that the add, delete, modify and set     operations now support automatic propagation of     inheritable ACE(s); (FATE#316474).

  - Attempt to use samlogon validation level 6; (bso#7945);
    (bnc#741623).

  - Recover from ncacn_ip_tcp ACCESS_DENIED/SEC_PKG_ERROR     lsa errors; (bso#7944); (bnc#755663).

  - Fix lsa_LookupSids3 and lsa_LookupNames4 arguments.

  - Use simplified smb signing infrastructure; (bnc#741623).

- Update to 4.1.3.

  + DCE-RPC fragment length field is incorrectly checked;
    CVE-2013-4408; (bnc#844720).

  + pam_winbind login without require_membership_of     restrictions; CVE-2012-6150; (bnc#853347).

  - Make use of the full gpg pub key file name including the     key ID.

  - Add transparent file compression support; (fate#316266).

  + Implement FSCTL_GET_COMPRESSION and     FSCTL_SET_COMPRESSION handlers.

  + Add FILE_ATTRIBUTE_COMPRESSED and FILE_NO_COMPRESSION     support.

  + Extend vfs_btrfs VFS module to utilize get/set     compression hooks.

  - Add support for FSCTL_SRV_COPYCHUNK_WRITE;
    (fate#314770).

  - Remove bogus libsmbclient0 package description and     cleanup the libsmbclient line from baselibs.conf;
    (bnc#853021).

  - BuildRequire systemd on post-12.2 systems.

  - Update to 4.1.2.

  + s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled;
    (bso#9091).

  + dfs_server: Use dsdb_search_one to catch 0 results as     well as NO_SUCH_OBJECT errors; (bso#10052).

  + Missing talloc_free can leak stackframe in error path;
    (bso#10187).

  + Fix memset used with constant zero length parameter;
    (bso#10190).

  + s4:dsdb/rootdse: report 'dnsHostName' instead of     'dNSHostName'; (bso#10193).

  + Make offline logon cache updating for cross child domain     group membership; (bso#10194).

  + nsswitch: Fix short writes in winbind_write_sock;
    (bso#10195).

  + RW Deny for a specific user is not overriding RW Allow     for a group; (bso#10196).

  + vfs_glusterfs: Fix excessive debug output from     vfs_gluster_open(); (bso#10224).

  + vfs_glusterfs: Implement proper mashalling/unmarshalling     of ACLs; (bso#10224).

  + VFS plugin was sending the actual size of the volume     instead of the total number of block units because of     which windows was getting the wrong &#9; volume     capacity; (bso#10224).

  + libcli/smb: Fix smb2cli_ioctl*() against Windows 2008;
    (bso#10232).

  + xattr: Fix listing EAs on *BSD for non-root users;
    (bso#10247).

  + Fix the build of vfs_glusterfs; (bso#10253).

  + s3-winbindd: Fix cache_traverse_validate_fn failure for     NDR cache entries; (bso#10264).

  + util: Remove 32bit macros breaking strict aliasing;
    (bso#10269).

  - Let gpg verify execution condition not fail on non SUSE     systems.

  - Add systemd support for post-12.2 systems.

  - Update to 4.1.1.

  + ACLs are not checked on opening an alternate data stream     on a file or directory; CVE-2013-4475; (bso#10229);
    (bnc#848101).

  + Private key in key.pem world readable; CVE-2013-4476;
    (bnc#848103).

Updated samba4 packages that fix three security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller.
(CVE-2013-4496)

A flaw was found in Samba's 'smbcacls' command, which is used to set or get ACLs on SMB file shares. Certain command line options of this command would incorrectly remove an ACL previously applied on a file or a directory, leaving the file or directory without the intended ACL. (CVE-2013-6442)

A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service. (CVE-2012-6150)

Red Hat would like to thank the Samba project for reporting CVE-2013-4496 and CVE-2013-6442, and Sam Richardson for reporting CVE-2012-6150. Upstream acknowledges Andrew Bartlett as the original reporter of CVE-2013-4496, and Noel Power as the original reporter of CVE-2013-6442.

All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller.
(CVE-2013-4496)

A flaw was found in Samba's 'smbcacls' command, which is used to set or get ACLs on SMB file shares. Certain command line options of this command would incorrectly remove an ACL previously applied on a file or a directory, leaving the file or directory without the intended ACL. (CVE-2013-6442)

A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service. (CVE-2012-6150)

After installing this update, the smb service will be restarted automatically.

From Red Hat Security Advisory 2014:0383 :

Updated samba4 packages that fix three security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller.
(CVE-2013-4496)

A flaw was found in Samba's 'smbcacls' command, which is used to set or get ACLs on SMB file shares. Certain command line options of this command would incorrectly remove an ACL previously applied on a file or a directory, leaving the file or directory without the intended ACL. (CVE-2013-6442)

A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service. (CVE-2012-6150)

Red Hat would like to thank the Samba project for reporting CVE-2013-4496 and CVE-2013-6442, and Sam Richardson for reporting CVE-2012-6150. Upstream acknowledges Andrew Bartlett as the original reporter of CVE-2013-4496, and Noel Power as the original reporter of CVE-2013-6442.

All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller.
(CVE-2013-4496)

A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service. (CVE-2012-6150)

After installing this update, the smb service will be restarted automatically.

Updated samba3x and samba packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller.
(CVE-2013-4496)

A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service. (CVE-2012-6150)

Red Hat would like to thank the Samba project for reporting CVE-2013-4496 and Sam Richardson for reporting CVE-2012-6150. Upstream acknowledges Andrew Bartlett as the original reporter of CVE-2013-4496.

All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

From Red Hat Security Advisory 2014:0330 :

Updated samba3x and samba packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller.
(CVE-2013-4496)

A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service. (CVE-2012-6150)

Red Hat would like to thank the Samba project for reporting CVE-2013-4496 and Sam Richardson for reporting CVE-2012-6150. Upstream acknowledges Andrew Bartlett as the original reporter of CVE-2013-4496.

All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

This update fixes the following security issues with samba :

  - DCERPC frag_len not checked. (CVE-2013-4408).
    (bnc#844720)

  - winbind pam security problem. (CVE-2012-6150).
    (bnc#853347)

  - No access check verification on stream files     (CVE-2013-4475). And fixes the following non-security     issues :. (bnc#848101)

  - libsmbclient0 package description contains comments.
    (bnc#853021)

  - rpcclient adddriver and setdrive do not set all needed     registry entries. (bnc#817880)

  - Client trying to delete print job fails: Samba returns:
    WERR_INVALID_PRINTER_NAME. (bnc#838472)

  - various upstream fixes. (bnc#854520 and bnc#849226)

According to its banner, the version of Samba running on this system (i.e., earlier than 3.6.22 / 4.0.13 / 4.1.3) contain the following known vulnerabilities:

  - A security bypass vulnerability via the 'winbind_name_list_to_sid_string_list()' that would allow a malicious authenticated user to modify the 'pam_winbind' configuration file. (CVE-2012-6150)

  - A buffer overflow vulnerability in the 'dcerpc_read_ncacn_packet_done()' function that can allow remote AD domain controllers to execute arbitrary code (CVE-2013-4408)

  - ACLs were not checked when opening files with alternate data streams, though this issue is only exploitable if the VFS modules vfs_streams_depot and/or vfs_streams_xattr are used. (CVE-2013-4475)

Fix NULL pointer derreference in winbind debug message. Update to version 4.1.3 which fixes two security bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in samba :

The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake (CVE-2012-6150).

Buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet (CVE-2013-4408).

The updated packages has been upgraded to the 3.6.22 version which resolves various upstream bugs and is not vulnerable to these issues.

This updates Samba to version 4.0.13, which fixes two security bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Samba running on the remote host is 3.3.x equal or later than 3.3.10, 3.4.x, 3.5.x, 3.6.x prior to 3.6.22, 4.0.x prior to 4.0.13 or 4.1.x prior to 4.1.3.  It is, therefore, potentially affected by multiple vulnerabilities :

  - A security bypass vulnerability exists in the     'winbind_name_list_to_sid_string_list()' function of the     'nsswitch/pam_winbind.c' source file. Exploitation could     allow a malicious, authenticated user access to the     'pam_winbind' configuration file. (CVE-2012-6150)

  - A buffer overflow exists in the     'dcerpc_read_ncacn_packet_done' function of the     'librpc/rpc/dcerpc_util.c' source file that could allow     remote AD domain controllers to execute arbitrary code     on the remote host via DCE-RPC packet with an invalid     fragment length. (CVE-2013-4408)

Note that Nessus has relied only on the self-reported version number and has not actually tried to exploit this issue or determine if the associated patch has been applied.

It was discovered that Winbind incorrectly handled invalid group names with the require_membership_of parameter. If an administrator used an invalid group name by mistake, access was granted instead of having the login fail. (CVE-2012-6150)

Stefan Metzmacher and Michael Adam discovered that Samba incorrectly handled DCE-RPC fragment length fields. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code as the root user. (CVE-2013-4408)

Hemanth Thummala discovered that Samba incorrectly handled file permissions when vfs_streams_depot or vfs_streams_xattr were enabled.
A remote attacker could use this issue to bypass intended restrictions. (CVE-2013-4475).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Samba project reports :

These are security releases in order to address CVE-2013-4408 (DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150 (pam_winbind login without require_membership_of restrictions).

ID	Name	Product	Family	Severity
90609	openSUSE Security Update : samba (openSUSE-2016-490) (Badlock)	Nessus	SuSE Local Security Checks	high
83623	SUSE SLES11 Security Update : Samba (SUSE-SU-2014:0723-1)	Nessus	SuSE Local Security Checks	high
81536	GLSA-201502-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
80766	Oracle Solaris Third-Party Patch Update : samba (cve_2012_6150_input_validation)	Nessus	Solaris Local Security Checks	high
77268	Fedora 19 : samba-4.0.21-1.fc19 (2014-9132)	Nessus	Fedora Local Security Checks	high
76223	Fedora 20 : samba-4.1.9-3.fc20 (2014-7672)	Nessus	Fedora Local Security Checks	high
75302	openSUSE Security Update : samba (openSUSE-SU-2014:0405-1)	Nessus	SuSE Local Security Checks	high
75242	openSUSE Security Update : samba (openSUSE-SU-2013:1921-1)	Nessus	SuSE Local Security Checks	high
73464	CentOS 6 : samba4 (CESA-2014:0383)	Nessus	CentOS Local Security Checks	medium
73453	Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20140409)	Nessus	Scientific Linux Local Security Checks	medium
73452	RHEL 6 : samba4 (RHSA-2014:0383)	Nessus	Red Hat Local Security Checks	medium
73450	Oracle Linux 6 : samba4 (ELSA-2014-0383)	Nessus	Oracle Linux Local Security Checks	medium
73201	Scientific Linux Security Update : samba and samba3x on SL5.x, SL6.x i386/srpm/x86_64 (20140325)	Nessus	Scientific Linux Local Security Checks	medium
73199	RHEL 5 / 6 : samba and samba3x (RHSA-2014:0330)	Nessus	Red Hat Local Security Checks	medium
73197	Oracle Linux 5 / 6 : samba / samba3x (ELSA-2014-0330)	Nessus	Oracle Linux Local Security Checks	medium
73192	CentOS 5 / 6 : samba / samba3x (CESA-2014:0330)	Nessus	CentOS Local Security Checks	medium
71833	SuSE 11.2 / 11.3 Security Update : Samba (SAT Patch Numbers 8655 / 8656)	Nessus	SuSE Local Security Checks	high
8075	Samba < 3.6.22 / 4.0.13 / 4.1.3 Multiple Vulnerabilities	Nessus Network Monitor	Samba	high
71620	Fedora 20 : samba-4.1.3-2.fc20 (2013-23177)	Nessus	Fedora Local Security Checks	high
71606	Mandriva Linux Security Advisory : samba (MDVSA-2013:299)	Nessus	Mandriva Local Security Checks	high
71447	Fedora 19 : samba-4.0.13-1.fc19 (2013-23085)	Nessus	Fedora Local Security Checks	high
71377	Samba 3.x < 3.6.22 / 4.0.x < 4.0.13 / 4.1.x < 4.1.3 Multiple Vulnerabilities	Nessus	Misc.	high
71376	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 / 13.10 : samba vulnerabilities (USN-2054-1)	Nessus	Ubuntu Local Security Checks	high
71285	FreeBSD : samba -- multiple vulnerabilities (613e45d1-6154-11e3-9b62-000c292e4fd8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2012-6150

medium

Tenable Plugins

high

high

critical

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high