A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1878 advisory.

  - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and access the contents of directories outside the     share. (CVE-2019-10197)

  - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.
    (CVE-2019-10218)

  - All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where     if it is set with log level = 3 (or above) then the string obtained from the client, after a failed     character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange.
    In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to     terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a     crash there is harmless). (CVE-2019-14907)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1084 advisory.

  - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and access the contents of directories outside the     share. (CVE-2019-10197)

  - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.
    (CVE-2019-10218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1878 advisory.

  - samba: Combination of parameters and permissions can allow user to escape from the share path definition     (CVE-2019-10197)

  - samba: smb client vulnerable to filenames containing path separators (CVE-2019-10218)

  - samba: Crash after failed character conversion at log level 3 or above (CVE-2019-14907)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has samba packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and access the contents of directories outside the     share. (CVE-2019-10197)

  - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.
    (CVE-2019-10218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has samba packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and access the contents of directories outside the     share. (CVE-2019-10197)

  - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.
    (CVE-2019-10218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1878 advisory.

  - samba: Combination of parameters and permissions can allow user to escape from the share path definition     (CVE-2019-10197)

  - samba: smb client vulnerable to filenames containing path separators (CVE-2019-10218)

  - samba: Crash after failed character conversion at log level 3 or above (CVE-2019-14907)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1424 advisory.

  - A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and access the contents of directories outside the     share. (CVE-2019-10197)

  - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.
    (CVE-2019-10218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.
(CVE-2019-10218)

A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share. (CVE-2019-10197)

* samba: Combination of parameters and permissions can allow user to escape from the share path definition * samba: smb client vulnerable to filenames containing path separators

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1084 advisory.

  - samba: Combination of parameters and permissions can     allow user to escape from the share path definition     (CVE-2019-10197)

  - samba: smb client vulnerable to filenames containing     path separators (CVE-2019-10218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1084 advisory.

  - samba: Combination of parameters and permissions can allow user to escape from the share path definition     (CVE-2019-10197)

  - samba: smb client vulnerable to filenames containing path separators (CVE-2019-10218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code, cause a Denial       of Service condition, conduct a man-in-the-middle attack, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Samba from version 4.9.0 and before version 4.9.3 that     have AD DC configurations watching for bad passwords     (to restrict brute forcing of passwords) in a window of     more than 3 minutes may not watch for bad passwords at     all. The primary risk from this issue is with regards     to domains that have been upgraded from Samba 4.8 and     earlier. In these cases the manual testing done to     confirm an organisation's password policies apply as     expected may not have been re-done after the     upgrade.(CVE-2018-16857)

  - Samba from version 4.9.0 and before version 4.9.3 is     vulnerable to a NULL pointer de-reference. During the     processing of an DNS zone in the DNS management DCE/RPC     server, the internal DNS server or the Samba DLZ plugin     for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS     property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property     is set, the server will follow a NULL pointer and     terminate. There is no further vulnerability associated     with this issue, merely a denial of     service.(CVE-2018-16852)

  - A flaw was found in samba versions 4.9.x up to 4.9.13,     samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the     samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and     access the contents of directories outside the     share.(CVE-2019-10197)

  - A flaw was found in samba 4.0.0 before samba 4.9.15 and     samba 4.10.x before 4.10.10. An attacker can crash AD     DC LDAP server via dirsync resulting in denial of     service. Privilege escalation is not possible with this     issue.(CVE-2019-14847)

  - A flaw was found in Samba, all versions starting samba     4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2,     in the way it handles a user password change or a new     password for a samba user. The Samba Active Directory     Domain Controller can be configured to use a custom     script to check for password complexity. This     configuration can fail to verify password complexity     when non-ASCII characters are used in the password,     which could lead to weak passwords being set for samba     users, making it vulnerable to dictionary     attacks.(CVE-2019-14833)

  - A flaw was found in the samba client, all samba     versions before samba 4.11.2, 4.10.10 and 4.9.15, where     a malicious server can supply a pathname to the client     with separators. This could allow the client to access     files and folders outside of the SMB network pathnames.
    An attacker could use this vulnerability to create     files outside of the current working directory using     the privileges of the client user.(CVE-2019-10218)

  - A flaw was found in the way an LDAP search expression     could crash the shared LDAP server process of a samba     AD DC in samba before version 4.10. An authenticated     user, having read permissions on the LDAP server, could     use this flaw to cause denial of     service.(CVE-2019-3824)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the S4U (MS-SFU) Kerberos delegation model includes a     feature allowing for a subset of clients to be opted     out of constrained delegation in any way, either     S4U2Self or regular Kerberos authentication, by forcing     all tickets for these clients to be non-forwardable. In     AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which     translates to disallow-forwardable. However the Samba     AD DC does not do that for S4U2Self and does set the     forwardable flag even if the impersonated client has     the not-delegated flag set.(CVE-2019-14870)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before     4.10.11 and 4.11.x before 4.11.3 have an issue, where     the (poorly named) dnsserver RPC pipe provides     administrative facilities to modify DNS records and     zones. Samba, when acting as an AD DC, stores DNS     records in LDAP. In AD, the default permissions on the     DNS partition allow creation of new records by     authenticated users. This is used for example to allow     machines to self-register in DNS. If a DNS record was     created that case-insensitively matched the name of the     zone, the ldb_qsort() and dns_name_compare() routines     could be confused into reading memory prior to the list     of DNS entries when responding to DnssrvEnumRecords()     or DnssrvEnumRecords2() and so following invalid memory     as a pointer.(CVE-2019-14861)

  - A flaw was found in samba's Heimdal KDC implementation,     versions 4.8.x up to, excluding 4.8.12, 4.9.x up to,     excluding 4.9.8 and 4.10.x up to, excluding 4.10.3,     when used in AD DC mode. A man in the middle attacker     could use this flaw to intercept the request to the KDC     and replace the user name (principal) in the request     with any desired user name (principal) that exists in     the KDC effectively obtaining a ticket for that     principal.(CVE-2018-16860)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:4023 advisory.

  - samba: Combination of parameters and permissions can allow user to escape from the share path definition     (CVE-2019-10197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba versions 4.9.x up to 4.9.13,     samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the     samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and     access the contents of directories outside the     share.(CVE-2019-10197)

  - A null pointer dereference flaw was found in the Samba     DNS Management server when used as an Active Directory     Domain Controller. A remote attacker could use this     flaw to cause a denial of service (application     crash).Samba from version 4.9.0 and before version     4.9.3 is vulnerable to a NULL pointer de-reference.
    During the processing of an DNS zone in the DNS     management DCE/RPC server, the internal DNS server or     the Samba DLZ plugin for BIND9, if the     DSPROPERTY_ZONE_MASTER_SERVERS property or     DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the     server will follow a NULL pointer and terminate. There     is no further vulnerability associated with this issue,     merely a denial of service.(CVE-2018-16852)

  - It was found that the 'bad password observation window'     was ineffective when set to a value greater than 3     minutes. This could allow for brute force password     attacks in some situations.(CVE-2018-16857)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3253 advisory.

  - samba: Combination of parameters and permissions can allow user to escape from the share path definition     (CVE-2019-10197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to Samba 4.11.0

----

Update to Samba 4.11.0rc4

----

Update to Samba 4.11.0rc3 - Security fixes for CVE-2019-10197

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.9.13 - Security fixes for CVE-2019-10197

----

Update to Samba 4.9.12

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.10.8 - Security fixes for CVE-2019-10197

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

Security issue fixed :

  - CVE-2019-10197: Fixed user escape from share path     definition (bsc#1141267).

Bug fix :

  - Prepare for future use of kernel keyrings, modify     /etc/pam.d/samba to include pam_keyinit.so;
    (bsc#1144059).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The version of Samba running on the remote host is 4.9.x prior to 4.9.13, 4.10.x prior to 4.10.3.8, or 4.11.x prior to 4.11.0rc3. It is, therefore, affected by security bypass vulnerability.
An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Stefan Metzmacher discovered that the Samba SMB server did not properly prevent clients from escaping outside the share root directory in some situations. An attacker could use this to gain access to files outside of the Samba share, where allowed by the permissions of the underlying filesystem.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The samba project reports :

On a Samba SMB server for all versions of Samba from 4.9.0 clients are able to escape outside the share root directory if certain configuration parameters set in the smb.conf file.

Stefan Metzmacher discovered a flaw in Samba, a SMB/CIFS file, print, and login server for Unix. Specific combinations of parameters and permissions can allow user to escape from the share path definition and see the complete '/' filesystem. Unix permission checks in the kernel are still enforced.

Details can be found in the upstream advisory at https://www.samba.org/samba/security/CVE-2019-10197.html

ID	Name	Product	Family	Severity
180910	Oracle Linux 8 : samba (ELSA-2020-1878)	Nessus	Oracle Linux Local Security Checks	critical
180709	Oracle Linux 7 : samba (ELSA-2020-1084)	Nessus	Oracle Linux Local Security Checks	critical
145876	CentOS 8 : samba (CESA-2020:1878)	Nessus	CentOS Local Security Checks	critical
145703	NewStart CGSL CORE 5.05 / MAIN 5.05 : samba Multiple Vulnerabilities (NS-SA-2020-0106)	Nessus	NewStart CGSL Local Security Checks	critical
143984	NewStart CGSL CORE 5.04 / MAIN 5.04 : samba Multiple Vulnerabilities (NS-SA-2020-0072)	Nessus	NewStart CGSL Local Security Checks	critical
143012	RHEL 8 : samba (RHSA-2020:1878)	Nessus	Red Hat Local Security Checks	critical
140088	Amazon Linux AMI : ctdb (ALAS-2020-1424)	Nessus	Amazon Linux Local Security Checks	critical
138625	Amazon Linux 2 : samba (ALAS-2020-1459)	Nessus	Amazon Linux Local Security Checks	critical
135836	Scientific Linux Security Update : samba on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	critical
135334	CentOS 7 : samba (CESA-2020:1084)	Nessus	CentOS Local Security Checks	critical
135054	RHEL 7 : samba (RHSA-2020:1084)	Nessus	Red Hat Local Security Checks	critical
134927	GLSA-202003-52 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
132794	EulerOS Virtualization for ARM 64 3.0.5.0 : samba (EulerOS-SA-2020-1040)	Nessus	Huawei Local Security Checks	critical
131525	RHEL 6 : samba (RHSA-2019:4023)	Nessus	Red Hat Local Security Checks	critical
130825	EulerOS 2.0 SP8 : samba (EulerOS-SA-2019-2116)	Nessus	Huawei Local Security Checks	critical
130416	RHEL 7 : samba (RHSA-2019:3253)	Nessus	Red Hat Local Security Checks	critical
129614	Fedora 31 : 2:samba / libldb / libtalloc / libtevent (2019-41c7fa478a)	Nessus	Fedora Local Security Checks	critical
129035	Fedora 29 : 2:samba (2019-eb1e982800)	Nessus	Fedora Local Security Checks	critical
129034	Fedora 30 : 2:samba (2019-e3e521e5b3)	Nessus	Fedora Local Security Checks	critical
128964	openSUSE Security Update : samba (openSUSE-2019-2142)	Nessus	SuSE Local Security Checks	critical
128549	Samba 4.9.x < 4.9.13 / 4.10.x < 4.10.8 / 4.11.0rc3 Security Bypass (CVE-2019-10197)	Nessus	Misc.	critical
128507	Ubuntu 19.04 : samba vulnerability (USN-4121-1)	Nessus	Ubuntu Local Security Checks	critical
128492	FreeBSD : samba -- combination of parameters and permissions can allow user to escape from the share path definition (145a3e17-cea2-11e9-81e2-005056a311d1)	Nessus	FreeBSD Local Security Checks	critical
128479	Debian DSA-4513-1 : samba - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-10197

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical