Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.

The remote IBM Storwize device is running a version that is 1.3.x prior to 1.4.3.4 or 1.5.x prior to 1.5.0.2. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Apache HTTP Server. A remote     attacker can exploit this, via partial HTTP requests,     to cause a daemon outage, resulting in a denial of     service condition. (CVE-2007-6750)

  - An HTTP request smuggling vulnerability exists due to a     flaw in the bundled version of Apache Tomcat; when an     HTTP connector or AJP connector is used, Tomcat fails to     properly handle certain inconsistent HTTP request     headers. A remote attacker can exploit this flaw, via     multiple Content-Length headers or a Content-Length     header and a 'Transfer-Encoding: chunked' header, to     smuggle an HTTP request in one or more Content-Length     headers. (CVE-2013-4286)

  - A denial of service vulnerability exists in the bundled     version of Apache Tomcat due to improper processing of     chunked transfer coding with a large amount of chunked     data or whitespace characters in an HTTP header value     within a trailer field. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2013-4322)

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Apache Tomcat; an integer     overflow condition exists in the parseChunkHeader()     function in ChunkedInputFilter.java. A remote attacker     can exploit this, via a malformed chunk size that is     part of a chunked request, to cause excessive     consumption of resources, resulting in a denial of     service condition. (CVE-2014-0075)

  - A remote code execution vulnerability exists due to a     flaw in the bundled version of Apache Struts. A remote     attacker can manipulate the ClassLoader via the class     parameter, resulting in the execution of arbitrary Java     code. (CVE-2014-0094)

  - An XML External Entity (XXE) injection vulnerability     exists due to a flaw in the bundled version of Apache     Tomcat; an incorrectly configured XML parser accepts     XML external entities from an untrusted source via XSLT.
    A remote attacker can exploit this, by sending specially     crafted XML data, to gain access to arbitrary files.
    (CVE-2014-0096)

  - An integer overflow condition exists in the bundled     version of Apache Tomcat. A remote attacker, via a     crafted Content-Length HTTP header, can conduct HTTP     request smuggling attacks. (CVE-2014-0099)

  - An information disclosure vulnerability exists due to a     flaw in the bundled version of Apache Tomcat. Tomcat     fails to properly constrain the class loader that     accesses the XML parser used with an XSLT stylesheet. A     remote attacker can exploit this, via a crafted web     application that provides an XML external entity     declaration in conjunction with an entity reference, to     read arbitrary files. (CVE-2014-0119)

  - A flaw exists in a bundled version of Samba due to a     flaw in the vfswrap_fsctl() function that is triggered     when responding to FSCTL_GET_SHADOW_COPY_DATA or     FSCTL_SRV_ENUMERATE_SNAPSHOTS client requests. An     unauthenticated, remote attacker can exploit this, via     a specially crafted request, to disclose sensitive     information from process memory. (CVE-2014-0178)

  - Multiple flaws exist in the bundled version of Mozilla     Firefox that allow a remote attacker to execute     arbitrary code. (CVE-2014-1555, CVE-2014-1556,     CVE-2014-1557)

  - An information disclosure vulnerability exists due to     the chkauth password being saved in plaintext in the     audit log. A local attacker can exploit this to gain     administrator access. (CVE-2014-3077)

  - A denial of service vulnerability exists due to a flaw     in the bundled version of Samba. An authenticated,     remote attacker can exploit this, via an attempt to read     a Unicode pathname without specifying the use of     Unicode, to cause an application crash. (CVE-2014-3493)   
  - A security bypass vulnerability exists due to an     unspecified flaw. A remote attacker can exploit this     flaw to reset the administrator password to its default     value via a direct request to the administrative IP     address. Note that this vulnerability only affects the     1.4.x release levels. (CVE-2014-4811)

An error exists related to GET_SHADOW_COPY_DATA() and FSCTL_SRV_ENUMERATE_SNAPSHOTS() request handling in which the SRV_SNAPSHOT_ARRAY response field is not properly initialized. Therefore, configurations with 'shadow_copy' or 'shadow-copy2' specified for the 'vfs objects' parameter can allow the disclosure of uninitialized memory contents.

Updated samba packages fix security vulnerabilities :

In Samba before 3.6.23, the SAMR server neglects to ensure that attempted password changes will update the bad password count, and does not set the lockout flags. This would allow a user unlimited attempts against the password by simply calling ChangePasswordUser2 repeatedly. This is available without any other authentication (CVE-2013-4496).

Information leak vulnerability in the VFS code, allowing an authenticated user to retrieve eight bytes of uninitialized memory when shadow copy is enabled (CVE-2014-0178).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are vulnerable to a denial of service on the nmbd NetBIOS name services daemon. A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS ame service (CVE-2014-0244).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are affected by a denial of service crash involving overwriting memory on an authenticated connection to the smbd file server (CVE-2014-3493).

An uninitialized pointer use flaw was found in the Samba daemon (smbd). A malicious Samba client could send specially crafted netlogon packets that, when processed by smbd, could potentially lead to arbitrary code execution with the privileges of the user running smbd (by default, the root user) (CVE-2015-0240).

The remote host is affected by the vulnerability described in GLSA-201502-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, bypass intended file restrictions,       or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and     4.1.x before 4.1.8, when a certain vfs shadow copy     configuration is enabled, does not properly initialize     the SRV_SNAPSHOT_ARRAY response field, which allows     remote authenticated users to obtain potentially     sensitive information from process memory via a (1)     FSCTL_GET_SHADOW_COPY_DATA or (2)     FSCTL_SRV_ENUMERATE_SNAPSHOTS request. (CVE-2014-0178)

Update to Samba 4.0.21. CVE-2014-3560.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated samba4 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in Samba's NetBIOS message block daemon (nmbd). An attacker on the local network could use this flaw to send specially crafted packets that, when processed by nmbd, could possibly lead to arbitrary code execution with root privileges.
(CVE-2014-3560)

All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the smb service will be restarted automatically.

From Red Hat Security Advisory 2014:1009 :

Updated samba4 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in Samba's NetBIOS message block daemon (nmbd). An attacker on the local network could use this flaw to send specially crafted packets that, when processed by nmbd, could possibly lead to arbitrary code execution with root privileges.
(CVE-2014-3560)

All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the smb service will be restarted automatically.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0867 advisory.

  - samba: Uninitialized memory exposure (CVE-2014-0178)

  - samba: nmbd denial of service (CVE-2014-0244)

  - samba: smbd unicode path names denial of service (CVE-2014-3493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2014:0867 :

Updated samba packages that fix three security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A denial of service flaw was found in the way the sys_recvfile() function of nmbd, the NetBIOS message block daemon, processed non-blocking sockets. An attacker could send a specially crafted packet that, when processed, would cause nmbd to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2014-0244)

A flaw was found in the way Samba created responses for certain authenticated client requests when a shadow-copy VFS module was enabled. An attacker able to send an authenticated request could use this flaw to disclose limited portions of memory per each request.
(CVE-2014-0178)

It was discovered that smbd, the Samba file server daemon, did not properly handle certain files that were stored on the disk and used a valid Unicode character in the file name. An attacker able to send an authenticated non-Unicode request that attempted to read such a file could cause smbd to crash. (CVE-2014-3493)

Red Hat would like to thank Daniel Berteaud of FIREWALL-SERVICES SARL for reporting CVE-2014-0244, and the Samba project for reporting CVE-2014-0178 and CVE-2014-3493. The Samba project acknowledges Christof Schmitt as the original reporter of CVE-2014-0178, and Simon Arlott as the original reporter of CVE-2014-3493.

All Samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

Samba has been updated to fix two security issues and one non-security issue.

These security issues have been fixed :

  - Fix segmentation fault in smbd_marshal_dir_entry()'s     SMB_FIND_FILE_UNIXhandler. (CVE-2014-3493)

  - Fix nmbd denial of service. (CVE-2014-0244)

  - Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response     (CVE-2014-0178) These non-security issues have been     fixed :

  - Fix printer job purging; (bso#10612);. (bnc#879390)

Updated samba packages fix security vulnerabilities :

Information leak vulnerability in the VFS code, allowing an authenticated user to retrieve eight bytes of uninitialized memory when shadow copy is enabled (CVE-2014-0178).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are vulnerable to a denial of service on the nmbd NetBIOS name services daemon. A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS name service (CVE-2014-0244).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are affected by a denial of service crash involving overwriting memory on an authenticated connection to the smbd file server (CVE-2014-3493).

Updated samba packages that fix three security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A denial of service flaw was found in the way the sys_recvfile() function of nmbd, the NetBIOS message block daemon, processed non-blocking sockets. An attacker could send a specially crafted packet that, when processed, would cause nmbd to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2014-0244)

A flaw was found in the way Samba created responses for certain authenticated client requests when a shadow-copy VFS module was enabled. An attacker able to send an authenticated request could use this flaw to disclose limited portions of memory per each request.
(CVE-2014-0178)

It was discovered that smbd, the Samba file server daemon, did not properly handle certain files that were stored on the disk and used a valid Unicode character in the file name. An attacker able to send an authenticated non-Unicode request that attempted to read such a file could cause smbd to crash. (CVE-2014-3493)

Red Hat would like to thank Daniel Berteaud of FIREWALL-SERVICES SARL for reporting CVE-2014-0244, and the Samba project for reporting CVE-2014-0178 and CVE-2014-3493. The Samba project acknowledges Christof Schmitt as the original reporter of CVE-2014-0178, and Simon Arlott as the original reporter of CVE-2014-3493.

All Samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

samba was updated to version 4.1.9 to fix four security issues and various non-security bugs.

These security issues were fixed :

  - Fix nmbd denial of service (CVE-2014-0244)

  - Fix segmentation fault in smbd_marshall_dir_entry()'s     SMB_FIND_FILE_UNIX handler (CVE-2014-3493)

  - Malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response     (CVE-2014-0178)

  - DNS: Don't reply to replies (CVE-2014-0239)

samba was updated to fix three security issues and two non-security issues. &#9; These security issues were fixed :

  - Fix segmentation fault in smbd_marshall_dir_entry()'s     SMB_FIND_FILE_UNIX handler (CVE-2014-3493)

  - Fix nmbd denial of service (CVE-2014-0244)

  - Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response     (CVE-2014-0178)

These non-security issues were fixed :

  - Fix printer job purging; (bso#10612); (bnc#879390).

  - Package the get_printing_ticket binary with 0700     permissions on post-11.4 systems; (bnc#685093).

Christof Schmitt discovered that Samba incorrectly initialized a certain response field when vfs shadow copy was enabled. A remote authenticated attacker could use this issue to possibly obtain sensitive information. This issue only affected Ubuntu 13.10 and Ubuntu 14.04 LTS. (CVE-2014-0178)

It was discovered that the Samba internal DNS server incorrectly handled QR fields when processing incoming DNS messages. A remote attacker could use this issue to cause Samba to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0239)

Daniel Berteaud discovered that the Samba NetBIOS name service daemon incorrectly handled certain malformed packets. A remote attacker could use this issue to cause Samba to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0244)

Simon Arlott discovered that Samba incorrectly handled certain unicode path names. A remote authenticated attacker could use this issue to cause Samba to stop responding, resulting in a denial of service.
(CVE-2014-3493).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.1.9. Update to Samba 4.1.8 (CVE-2014-0178 samba:
Uninitialized memory exposure)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New samba packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

Multiple vulnerabilities were discovered and fixed in Samba, a SMB/CIFS file, print, and login server :

  - CVE-2014-0178     Information leak vulnerability in the VFS code, allowing     an authenticated user to retrieve eight bytes of     uninitialized memory when shadow copy is enabled.

  - CVE-2014-0244     Denial of service (infinite CPU loop) in the nmbd     Netbios name service daemon. A malformed packet can     cause the nmbd server to enter an infinite loop,     preventing it to process later requests to the Netbios     name service.

  - CVE-2014-3493     Denial of service (daemon crash) in the smbd file server     daemon. An authenticated user attempting to read a     Unicode path using a non-Unicode request can force the     daemon to overwrite memory at an invalid address.

Versions of Samba older than 4.0.18 or 4.1.8 are unpatched for the following vulnerabilities:

  - An error in the 'dns_process_send()' function in the internal DNS server can cause an infinite loop that results in denial of service, due to the server not checking the 'reply' flag in a DNS packet header when processing a request. (CVE-2014-0239)

  - A flaw in the 'vfswrap_fsctl()' function that is triggered when responding to authenticated FSCTL_GET_SHADOW_COPY_DATA or FSCTL_SRV_ENUMERATE_SNAPSHOTS client requests can result in the exposure of eight bytes of uninitialized memory. This affects versions of Samba 3.6.6 and onward. (CVE-2014-0178)

According to its banner, the version of Samba running on the remote host is 3.5.x or 3.6.x prior to 3.6.25 / 4.1.x prior to 4.1.8. It is, therefore, potentially affected by the following vulnerabilities :

  - An error exists related to GET_SHADOW_COPY_DATA() and     FSCTL_SRV_ENUMERATE_SNAPSHOTS() request handling in     which the SRV_SNAPSHOT_ARRAY response field is not     properly initialized. Therefore, configurations with     'shadow_copy' or 'shadow-copy2' specified for the     'vfs objects' parameter can allow the disclosure of     uninitialized memory contents. (CVE-2014-0178)

  - A denial of service vulnerability exists due to the     internal DNS server failing to check the 'reply' flag in     DNS packet headers. A remote attacker, via a forged     response packet that triggers a communication loop, can     cause the consumption of CPU processing and bandwidth.
    (CVE-2014-0239)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Samba running on the remote host is 4.x prior to 4.0.18 and is, therefore, potentially affected by the following vulnerabilities :

  - An error exists related to 'GET_SHADOW_COPY_DATA' or     'FSCTL_SRV_ENUMERATE_SNAPSHOTS' request handling and     'vfs objects' parameter configurations of 'shadow_copy'     or 'shadow_copy2' that could allow disclosure of     uninitialized memory contents. (CVE-2014-0178)

  - An error exists related to handling the 'reply' flag     DNS packet headers that could allow denial of service     attacks. (CVE-2014-0239)

Note that Nessus has relied only on the self-reported version number and has not actually tried to exploit these issues or determine if the associated patch has been applied.

ID	Name	Product	Family	Severity
84401	IBM Storwize 1.3.x < 1.4.3.4 / 1.5.x < 1.5.0.2 Multiple Vulnerabilities	Nessus	Misc.	high
8752	Samba 3.6.6 < 3.6.25 Memory Disclosure	Nessus Network Monitor	Samba	low
82335	Mandriva Linux Security Advisory : samba (MDVSA-2015:082)	Nessus	Mandriva Local Security Checks	critical
81536	GLSA-201502-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
80768	Oracle Solaris Third-Party Patch Update : samba (cve_2014_0178_information_disclosure)	Nessus	Solaris Local Security Checks	low
77268	Fedora 19 : samba-4.0.21-1.fc19 (2014-9132)	Nessus	Fedora Local Security Checks	high
77013	RHEL 6 : samba4 (RHSA-2014:1009)	Nessus	Red Hat Local Security Checks	high
77010	Oracle Linux 6 : samba4 (ELSA-2014-1009)	Nessus	Oracle Linux Local Security Checks	high
77006	CentOS 6 : samba4 (CESA-2014:1009)	Nessus	CentOS Local Security Checks	high
76903	RHEL 7 : samba (RHSA-2014:0867)	Nessus	Red Hat Local Security Checks	medium
76740	Oracle Linux 7 : samba (ELSA-2014-0867)	Nessus	Oracle Linux Local Security Checks	low
76523	SuSE 11.3 Security Update : Samba (SAT Patch Number 9451)	Nessus	SuSE Local Security Checks	low
76480	Mandriva Linux Security Advisory : samba (MDVSA-2014:136)	Nessus	Mandriva Local Security Checks	low
76432	CentOS 7 : samba (CESA-2014:0867)	Nessus	CentOS Local Security Checks	low
76341	openSUSE Security Update : samba (openSUSE-SU-2014:0859-1)	Nessus	SuSE Local Security Checks	medium
76340	openSUSE Security Update : samba (openSUSE-SU-2014:0857-1)	Nessus	SuSE Local Security Checks	low
76275	Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2257-1)	Nessus	Ubuntu Local Security Checks	high
76223	Fedora 20 : samba-4.1.9-3.fc20 (2014-7672)	Nessus	Fedora Local Security Checks	high
76207	Slackware 14.0 / 14.1 / current : samba (SSA:2014-175-04)	Nessus	Slackware Local Security Checks	medium
76194	Debian DSA-2966-1 : samba - security update	Nessus	Debian Local Security Checks	low
3540	Samba 4.0.x < 4.0.18 / 4.1.x < 4.1.8 Multiple Vulnerabilities	Nessus Network Monitor	Samba	medium
74290	Samba 3.5.x / 3.6.x < 3.6.25 / 4.1.x < 4.1.8 Multiple Vulnerabilities	Nessus	Misc.	low
74242	Samba 4.x < 4.0.18 Multiple Vulnerabilities	Nessus	Misc.	low

Detections

Analytics

CVE-2014-0178

medium

Tenable Plugins

high

low

critical

critical

low

high

high

high

high

medium

low

low

low

low

medium

low

high

high

medium

low

medium

low

low