smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

Various vulnerabilities were discovered in Samba, SMB/CIFS file, print, and login server/client for Unix

CVE-2017-9461

smbd in Samba had a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

CVE-2018-1050

Samba was vulnerable to a denial of service attack when the RPC spoolss service was configured to be run as an external daemon.
Missing input sanitization checks on some of the input parameters to spoolss RPC calls could have caused the print spooler service to crash.

CVE-2018-1057

On a Samba 4 AD DC the LDAP server of Samba incorrectly validated permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Thanks to the Ubuntu security team for having backported the rather invasive changeset to Samba in Ubuntu 14.04 (which we could use to patch Samba in Debian jessie LTS).

CVE-2019-3880

A flaw was found in the way Samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could have used this flaw to create a new registry hive file anywhere they had unix permissions which could have lead to creation of a new file in the Samba share.

For Debian 8 'Jessie', these problems have been fixed in version 2:4.2.14+dfsg-0+deb8u12.

We recommend that you upgrade your samba packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for samba is now available for Red Hat Gluster Storage 3.3 for RHEL 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories in areas of the server file system not exported under the share definitions.
(CVE-2017-2619)

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.

Bug Fix(es) :

* In the samba configuration, by default the 'posix locking' is enabled and 'stat cache' is disabled. Enabling 'posix locking' sends the file lock request to the bricks too, and disabling 'stat cache' blocks samba to cache certain information at the samba layer. This led to decrease in performance of SMB access of Red Hat Gluster Storage volumes

As a fix, the following two options are included in the samba configuration file: posix locking = No stat cache = Yes

Due to this, a slight improvement in the performance is observed.
(BZ#1436265)

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way Samba handled dangling     symlinks. An authenticated malicious Samba client could     use this flaw to cause the smbd daemon to enter an     infinite loop and use an excessive amount of CPU and     memory. (CVE-2017-9461)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version:
samba (4.6.2). (BZ#1391954)

Security Fix(es) :

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
samba (4.6.2).

Security Fix(es) :

  - A flaw was found in the way Samba handled dangling     symlinks. An authenticated malicious Samba client could     use this flaw to cause the smbd daemon to enter an     infinite loop and use an excessive amount of CPU and     memory. (CVE-2017-9461)

From Red Hat Security Advisory 2017:1950 :

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version:
samba (4.6.2). (BZ#1391954)

Security Fix(es) :

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

An update for samba is now available for Red Hat Gluster Storage 3.2 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions.
(CVE-2017-2619)

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.

It was discovered that Samba incorrectly handled dangling symlinks. A remote attacker could possibly use this issue to cause Samba to hang, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-9461)

In addition, this update fixes a regression introduced by USN-3267-1 that caused Samba to incorrectly handle non-wide symlinks to directories.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
123959	Debian DLA-1754-1 : samba security update	Nessus	Debian Local Security Checks	high
103453	RHEL 6 : Storage Server (RHSA-2017:2778)	Nessus	Red Hat Local Security Checks	high
103078	EulerOS 2.0 SP2 : samba (EulerOS-SA-2017-1220)	Nessus	Huawei Local Security Checks	medium
103077	EulerOS 2.0 SP1 : samba (EulerOS-SA-2017-1219)	Nessus	Huawei Local Security Checks	medium
102745	CentOS 7 : samba (CESA-2017:1950)	Nessus	CentOS Local Security Checks	medium
102656	Scientific Linux Security Update : samba on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	medium
102290	Oracle Linux 7 : samba (ELSA-2017-1950)	Nessus	Oracle Linux Local Security Checks	medium
102156	RHEL 7 : Red Hat Gluster Storage (RHSA-2017:2338)	Nessus	Red Hat Local Security Checks	high
102106	RHEL 7 : samba (RHSA-2017:1950)	Nessus	Red Hat Local Security Checks	medium
101262	Ubuntu 14.04 LTS / 16.04 LTS : Samba vulnerability (USN-3348-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2017-9461

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

high

medium

medium