An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202402-28 (Samba: Multiple Vulnerabilities)

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not     enforced if an admin configured server signing = required or for SMB2 connections to Domain Controllers     where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-     the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and     server, affecting the integrity of the data. (CVE-2023-3347)

  - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes. (CVE-2023-3961)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence. (CVE-2023-4154)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

  - A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9adeb354af advisory.

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4e69bf4c59 advisory.

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.18.9 / 4.19.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-334-01 advisory.

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-190 advisory.

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

  - A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise     unprivileged users to delete this attribute from any object in the directory. (CVE-2023-0225)

  - The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP     filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a     Samba AD DC. (CVE-2023-0614)

  - The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new     or reset passwords over a signed-only connection. (CVE-2023-0922)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-206 advisory.

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

  - A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise     unprivileged users to delete this attribute from any object in the directory. (CVE-2023-0225)

  - The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP     filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a     Samba AD DC. (CVE-2023-0614)

  - The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new     or reset passwords over a signed-only connection. (CVE-2023-0922)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
193021	EulerOS 2.0 SP9 : samba (EulerOS-SA-2024-1496)	Nessus	Huawei Local Security Checks	medium
193000	EulerOS 2.0 SP9 : samba (EulerOS-SA-2024-1517)	Nessus	Huawei Local Security Checks	medium
190761	GLSA-202402-28 : Samba: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
186531	Fedora 38 : samba (2023-9adeb354af)	Nessus	Fedora Local Security Checks	medium
186515	Fedora 39 : samba (2023-4e69bf4c59)	Nessus	Fedora Local Security Checks	medium
186492	Slackware Linux 15.0 / current samba Vulnerability (SSA:2023-334-01)	Nessus	Slackware Local Security Checks	medium
176934	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-190)	Nessus	Amazon Linux Local Security Checks	medium
176912	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-206)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2018-14628

medium

Tenable Plugins

medium

medium

critical

medium

medium

medium

medium

medium