There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and
    all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would
    not automatically be taken away on all domain controllers. (CVE-2019-14902)

  - All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where
    if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed
    character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange.
    In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to
    terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a
    crash there is harmless). (CVE-2019-14907)

  - There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions
    before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while
    other local variables still point at the original buffer. (CVE-2019-19344)

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3563 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3563-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Lee Garrett     September 12, 2023                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : samba     Version        : 2:4.9.5+dfsg-5+deb10u4     CVE ID         : CVE-2016-2124 CVE-2019-10218 CVE-2019-14833 CVE-2019-14847                      CVE-2019-14902 CVE-2019-14907 CVE-2019-19344     Debian Bug     :

    Several vulnerabilities were discovered in Samba, the SMB/CIFS file, print, and     login server for Unix.

    CVE-2016-2124

        A flaw was found in the way samba implemented SMB1 authentication. An         attacker could use this flaw to retrieve the plaintext password sent over         the wire even if Kerberos authentication was required.

    CVE-2019-10218

        A flaw was found in the samba client, all samba versions before samba         4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname         to the client with separators. This could allow the client to access files         and folders outside of the SMB network pathnames. An attacker could use this         vulnerability to create files outside of the current working directory using         the privileges of the client user.

    CVE-2019-14833

        A flaw was found in Samba, all versions starting samba 4.5.0 before samba         4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password         change or a new password for a samba user. The Samba Active Directory Domain         Controller can be configured to use a custom script to check for password         complexity. This configuration can fail to verify password complexity when         non-ASCII characters are used in the password, which could lead to weak         passwords being set for samba users, making it vulnerable to dictionary         attacks.

    CVE-2019-14847

        A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before         4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in         denial of service. Privilege escalation is not possible with this issue.

    CVE-2019-14902

        There is an issue in all samba 4.11.x versions before 4.11.5, all samba         4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18,         where the removal of the right to create or modify a subtree would not         automatically be taken away on all domain controllers.

    CVE-2019-14907

        All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x         before 4.11.5 have an issue where if it is set with log level = 3 (or         above) then the string obtained from the client, after a failed character         conversion, is printed. Such strings can be provided during the NTLMSSP         authentication exchange. In the Samba AD DC in particular, this may cause a         long-lived process(such as the RPC server) to terminate. (In the file server         case, the most likely target, smbd, operates as process-per-client and so a         crash there is harmless).

    CVE-2019-19344

        There is a use-after-free issue in all samba 4.9.x versions before 4.9.18,         all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions         before 4.11.5, essentially due to a call to realloc() while other local         variables still point at the original buffer.

    For Debian 10 buster, these problems have been fixed in version     2:4.9.5+dfsg-5+deb10u4.

    We recommend that you upgrade your samba packages.

    Admins of AD DC setups are reminded and strongly encouraged to upgrade to     bullseye and then bookworm, as AD DC setups are unsupported in buster since [DSA     5015-1], and in bullseye since [DSA 5477-1].

    [DSA 5015-1] https://www.debian.org/security/2021/dsa-5015     [DSA 5477-1] https://www.debian.org/security/2023/dsa-5477


    For the detailed security status of samba please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - There is a use-after-free issue in all samba 4.9.x     versions before 4.9.18, all samba 4.10.x versions     before 4.10.12 and all samba 4.11.x versions before     4.11.5, essentially due to a call to realloc() while     other local variables still point at the original     buffer.(CVE-2019-19344)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - There is a use-after-free issue in all samba 4.9.x     versions before 4.9.18, all samba 4.10.x versions     before 4.10.12 and all samba 4.11.x versions before     4.11.5, essentially due to a call to realloc() while     other local variables still point at the original     buffer.(CVE-2019-19344)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code, cause a Denial       of Service condition, conduct a man-in-the-middle attack, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Update to Samba 4.10.13

----

Update to Samba 4.10.12 - Security fixes for CVE-2019-14902, CVE-2019-14907 and CVE-2019-19344

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.11.6

----

Update to Samba 4.11.5 - Security fixes for CVE-2019-14902, CVE-2019-14907 and CVE-2019-19344

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

Security issues fixed :

  - CVE-2019-14907: Fixed a Server-side crash after charset     conversion failure during NTLMSSP processing     (bsc#1160888).

  - CVE-2019-14902: Fixed an issue where automatic     replication of ACLs down subtree on AD Directory is not     working (bsc#1160850).

  - CVE-2019-19344: Fixed a server crash when using dns zone     scavenging = yes (bsc#1160852).

Non-security issue fixed :

  - Fixed Ceph snapshot path handling relative to root     (bsc#1141320).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for samba fixes the following issues :

Security issues fixed :

CVE-2019-14907: Fixed a Server-side crash after charset conversion failure during NTLMSSP processing (bsc#1160888).

CVE-2019-14902: Fixed an issue where automatic replication of ACLs down subtree on AD Directory is not working (bsc#1160850).

CVE-2019-19344: Fixed a server crash when using dns zone scavenging = yes (bsc#1160852).

Non-security issue fixed :

Fixed Ceph snapshot path handling relative to root (bsc#1141320).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Samba Team reports :

CVE-2019-14902

The implementation of ACL inheritance in the Samba AD DC was not complete, and so absent a 'full-sync' replication, ACLs could get out of sync between domain controllers.

CVE-2019-14907

When processing untrusted string input Samba can read past the end of the allocated buffer when printing a 'Conversion error' message to the logs.

CVE-2019-19344

During DNS zone scavenging (of expired dynamic entries) there is a read of memory after it has been freed.

The version of Samba running on the remote host is 4.x prior to 4.9.18, 4.10.x prior to 4.10.12, or 4.11.x prior to 4.11.5.  It is, therefore, affected by multiple vulnerabilities:

  - An issue exists with ACL inheritance due to added or removed delegated rights not being inherited across     domain controllers. An authenticated, remote attacker can exploit this to create or remove a subtree when     the permission should have been removed from the user. (CVE-2019-14902)

  - A denial of service (DoS) vulnerability exists due to Samba incorrectly converting characters printed     during the NTLMSSP exchange when the log level is set to 3. An authenticated, remote attacker can exploit     this issue, to cause some long-lived processes like the RPC server to stop responding. (CVE-2019-14907)

  - A use-after-free error exists in the code used to 'tombstone' dynamically created DNS records that have     reached their expiry time, due to an improper realloc() call. An authenticated, remote attacker may be     able to exploit this to cause read memory to be written to the DB. (CVE-2019-19344)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4244-1 advisory.

    It was discovered that Samba did not automatically replicate ACLs set to inherit down a subtree on AD     Directory, contrary to expectations. This issue was only addressed in Ubuntu 18.04 LTS, Ubuntu 19.04 and     Ubuntu 19.10. (CVE-2019-14902)

    Robert wicki discovered that Samba incorrectly handled certain character conversions when the log     level is set to 3 or above. In certain environments, a remote attacker could possibly use this issue to     cause Samba to crash, resulting in a denial of service. (CVE-2019-14907)

    Christian Naumer discovered that Samba incorrectly handled DNS zone scavenging. This issue could possibly     result in some incorrect data being written to the DB. This issue only applied to Ubuntu 19.04 and Ubuntu     19.10. (CVE-2019-19344)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
424471	Alpine: multiple ldb packages, multiple samba packages, pam-winbind: security update to 4.11.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424471	Alpine: multiple ldb packages, multiple samba packages, pam-winbind: security update to 4.11.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
502451	Synology DiskStation Manager Samba Use After Free (CVE-2019-19344)	Tenable OT Security	Tenable.ot	medium
407061	Alpine: samba: security update to 4.11.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407061	Alpine: samba: security update to 4.11.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
407050	Alpine: samba: security update to 4.10.12-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
407050	Alpine: samba: security update to 4.10.12-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
181444	Debian dla-3563 : ctdb - security update	Nessus	Debian Local Security Checks	medium
137803	EulerOS Virtualization for ARM 64 3.0.6.0 : samba (EulerOS-SA-2020-1696)	Nessus	Huawei Local Security Checks	medium
135744	EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-1511)	Nessus	Huawei Local Security Checks	medium
134927	GLSA-202003-52 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
133586	Fedora 30 : 2:samba (2020-f92cd0e72b)	Nessus	Fedora Local Security Checks	medium
133425	Fedora 31 : 2:samba (2020-6bd386c7eb)	Nessus	Fedora Local Security Checks	medium
133343	openSUSE Security Update : samba (openSUSE-2020-122)	Nessus	SuSE Local Security Checks	medium
133254	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2020:0223-1)	Nessus	SuSE Local Security Checks	medium
133244	FreeBSD : samba -- multiple vulnerabilities (5f0dd349-40a2-11ea-8d8c-005056a311d1)	Nessus	FreeBSD Local Security Checks	medium
133210	Samba 4.x < 4.9.18 / 4.10.x < 4.10.12 / 4.11.x < 4.11.5 Multiple Vulnerabilities	Nessus	Misc.	medium
133178	Ubuntu 16.04 LTS / 18.04 LTS : Samba vulnerabilities (USN-4244-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2019-19344

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium