The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before
    4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a
    UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.
    (CVE-2015-7560)

  - The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x
    before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of
    service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a
    crafted DNS TXT record. (CVE-2016-0771)

According to its banner, the version of Samba running on the remote host is 3.2.x prior to 4.1.23, 4.2.x prior to 4.2.9, 4.3.x prior to 4.3.6, or 4.4.0 prior to 4.4.0rc4. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists in the SMB1     implementation that is triggered when a symlink created     to a file or directory using SMB1 UNIX extensions is     accessed using non-UNIX SMB1 calls. An authenticated,     remote attacker can exploit this to overwrite file and     directory ACLs. (CVE-2015-7560)

  - An out-of-bounds read error exists in the internal DNS     server due to improper handling of TXT records when an     AD DC is configured. An authenticated, remote attacker     can exploit this, via a crafted DNS TXT record, to cause     a crash or disclose memory contents. (CVE-2016-0771)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for samba fixes the following issues :

Version update to 4.1.23.

  + Getting and setting Windows ACLs on symlinks can change     permissions on link target; CVE-2015-7560; (bso#11648);
    (boo#968222).

  + Fix Out-of-bounds read in internal DNS server;
    CVE-2016-0771; (bso#11128); (bso#11686); (boo#968223).

Also fixed :

  - Ensure samlogon fallback requests are rerouted after     kerberos failure; (bnc#953382); (bnc#953972).

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2015-7560     Jeremy Allison of Google, Inc. and the Samba Team     discovered that Samba incorrectly handles getting and     setting ACLs on a symlink path. An authenticated     malicious client can use SMB1 UNIX extensions to create     a symlink to a file or directory, and then use non-UNIX     SMB1 calls to overwrite the contents of the ACL on the     file or directory linked to.

  - CVE-2016-0771     Garming Sam and Douglas Bagnall of Catalyst IT     discovered that Samba is vulnerable to an out-of-bounds     read issue during DNS TXT record handling, if Samba is     deployed as an AD DC and chosen to run the internal DNS     server. A remote attacker can exploit this flaw to cause     a denial of service (Samba crash), or potentially, to     allow leakage of memory from the server in the form of a     DNS TXT reply.

Additionally this update includes a fix for a regression introduced due to the upstream fix for CVE-2015-5252 in DSA-3433-1 in setups where the share path is '/'.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2922-1 advisory.

    Jeremy Allison discovered that Samba incorrectly handled ACLs on symlink paths. A remote attacker could     use this issue to overwrite the ownership of ACLs using symlinks. (CVE-2015-7560)

    Garming Sam and Douglas Bagnall discovered that the Samba internal DNS server incorrectly handled certain     DNS TXT records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of     service, or possibly obtain uninitialized memory contents. This issue only applied to Ubuntu 14.04 LTS and     Ubuntu 15.10. (CVE-2016-0771)

    It was discovered that the Samba Web Administration Tool (SWAT) was vulnerable to clickjacking and cross-     site request forgery attacks. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-0213, CVE-2013-0214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New samba packages are available for Slackware 14.1 and -current to fix security issues.

ID	Name	Product	Family	Severity
400986	Alpine: libsmbclient, pam-winbind, multiple samba packages: security update to 4.2.7-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400986	Alpine: libsmbclient, pam-winbind, multiple samba packages: security update to 4.2.7-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
90098	Samba 3.2.x < 4.1.23 / 4.2.x < 4.2.9 / 4.3.x < 4.3.6 / 4.4.0 < 4.4.0rc4 Multiple Vulnerabilities	Nessus	Misc.	high
90054	openSUSE Security Update : samba (openSUSE-2016-359)	Nessus	SuSE Local Security Checks	medium
89876	Debian DSA-3514-1 : samba - security update	Nessus	Debian Local Security Checks	medium
89777	Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2922-1)	Nessus	Ubuntu Local Security Checks	medium
89759	Slackware 14.1 / current : samba (SSA:2016-068-02)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2016-0771

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

medium