A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.

The remote host is affected by the vulnerability described in GLSA-202402-28 (Samba: Multiple Vulnerabilities)

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not     enforced if an admin configured server signing = required or for SMB2 connections to Domain Controllers     where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-     the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and     server, affecting the integrity of the data. (CVE-2023-3347)

  - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes. (CVE-2023-3961)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence. (CVE-2023-4154)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

  - A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of QNAP QTS / QuTS hero installed on the remote host is affected by multiple vulnerabilities as referenced in the QSA-23-20 advisory.

  - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes. (CVE-2023-3961)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence. (CVE-2023-4154)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

  - A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8c9251e479 advisory.

  - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes. (CVE-2023-3961)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence. (CVE-2023-4154)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

  - A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-fff0c857d6 advisory.

  - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes. (CVE-2023-3961)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence. (CVE-2023-4154)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

  - A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6425-3 advisory.

  - The vulnerability exists due to an error in the way SMB protocol implementation in Samba handles file     operations. A remote user can request read-only access to files and then truncate them to 0 bytes by     opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf     setting acl_xattr:ignore system acls = yes. (CVE-2023-4091)

  - The vulnerability exists due to a design error in Samba's implementation of the DirSync control, which can     allow replication of critical domain passwords and secrets by Active Directory accounts authorized to do     some replication, but not to replicate sensitive attributes. A remote user can obtain sensitive     information from the AD DC and compromise the Active Directory. (CVE-2023-4154)

  - The vulnerability exists due to inclusion of the rpcecho server into production build, which can call     sleep() on AD DC. A remote user can request the server block using the rpcecho server and perform a     denial of service (DoS) attack. (CVE-2023-42669)

  - The vulnerability exists due to improper management of internal resources within the application when     Samba RPC server is under load, which can lead to incorrect start of servers not built for the AD DC. A     remote user can cause a high load to Samba RPC server and perform a denial of service (DoS) attack.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Samba running on the remote host is potentially affected by multiple vulnerabilities, as follows:

  - Insufficient sanitisation of incoming client pipe names leading to directory traversal outside of the     private directory meant to restrict the services that clients could connect to. Depending on the     service the client can connect to, the client may be able to trigger adverse events such as denial of     service, crashing the service, or potentially compromising it. (CVE-2023-3961)

  - When Samba's RPC server is under load, or otherwise not responding, the servers NOT built for the     AD DC can be incorrectly started, and compete to listen on the same unix domain sockets. This then     results in some queries being answered by the AD DC, and some not. This issue can be triggered     maliciously, to prevent service on the AD DC. (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4046-1 advisory.

  - The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ (Inter-Process Communication)     share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0,     Samba internally connects client pipe names to unix domain sockets within a private directory, allowing     clients to connect to services listening on those sockets. This is usually used to connect SMB clients to     remote proceedure call (RPC) services, such as SAMR LSA, or SPOOLSS, which Samba starts on demand.
    However, insufficient sanitization was done on the incoming client pipe name, meaning that a client     sending a pipe name containing unix directory traversal characters (../) could cause Samba to connect to     unix domain sockets outside of the private directory meant to restrict the services a client could connect     to. Samba connects to the unix domain sockets as root, meaning if a client could send a pipe name that     resolved to an external service using an existing unix domain socket, the client would be able to connect     to it without filesystem permissions restricting access. Depending on the service the client can connect     to, the client may be able to trigger adverse events such as denial of service, crashing the service, or     potentially compromising it. There are no current known exploits for this bug. (CVE-2023-3961)

  - The vulnerability exists due to an error in the way SMB protocol implementation in Samba handles file     operations. A remote user can request read-only access to files and then truncate them to 0 bytes by     opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf     setting acl_xattr:ignore system acls = yes. (CVE-2023-4091)

  - The vulnerability exists due to a design error in Samba's implementation of the DirSync control, which can     allow replication of critical domain passwords and secrets by Active Directory accounts authorized to do     some replication, but not to replicate sensitive attributes. A remote user can obtain sensitive     information from the AD DC and compromise the Active Directory. (CVE-2023-4154)

  - The vulnerability exists due to inclusion of the rpcecho server into production build, which can call     sleep() on AD DC. A remote user can request the server block using the rpcecho server and perform a     denial of service (DoS) attack. (CVE-2023-42669)

  - The vulnerability exists due to improper management of internal resources within the application when     Samba RPC server is under load, which can lead to incorrect start of servers not built for the AD DC. A     remote user can cause a high load to Samba RPC server and perform a denial of service (DoS) attack.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7eb8cbf1a5 advisory.

  - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes. (CVE-2023-3961)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence. (CVE-2023-4154)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

  - A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5525 advisory.

  - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes. (CVE-2023-3961)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence. (CVE-2023-4154)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

  - A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.18.8 / 4.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-284-03 advisory.

  - The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ (Inter-Process Communication)     share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0,     Samba internally connects client pipe names to unix domain sockets within a private directory, allowing     clients to connect to services listening on those sockets. This is usually used to connect SMB clients to     remote proceedure call (RPC) services, such as SAMR LSA, or SPOOLSS, which Samba starts on demand.
    However, insufficient sanitization was done on the incoming client pipe name, meaning that a client     sending a pipe name containing unix directory traversal characters (../) could cause Samba to connect to     unix domain sockets outside of the private directory meant to restrict the services a client could connect     to. Samba connects to the unix domain sockets as root, meaning if a client could send a pipe name that     resolved to an external service using an existing unix domain socket, the client would be able to connect     to it without filesystem permissions restricting access. Depending on the service the client can connect     to, the client may be able to trigger adverse events such as denial of service, crashing the service, or     potentially compromising it. There are no current known exploits for this bug. (CVE-2023-3961)

  - The SMB protocol allows opening files where the client requests read-only access, but then implicitly     truncating the opened file if the client specifies a separate OVERWRITE create disposition. This operation     requires write access to the file, and in the default Samba configuration the operating system kernel will     deny access to open a read-only file for read/write (which the truncate operation requires). However, when     Samba has been configured to ignore kernel file system permissions, Samba will truncate a file when the     underlying operating system kernel would deny the operation. Affected Samba configurations are the ones     where kernel file-system permission checks are bypassed, relying on Samba's own permission enforcement.
    The error is that this check is done against the client request for read-only access, and not the     implicitly requested read-write (for truncate) one. The widely used Samba VFS module acl_xattr when     configured with the module configuration parameter acl_xattr:ignore system acls = yes is the only     upstream Samba module that allows this behavior and is the only known method of reproducing this security     flaw. If (as is the default) the module configuration parameter acl_xattr:ignore system acls=no, then     the Samba server is not vulnerable to this attack. (CVE-2023-4091)

  - In normal operation, passwords and (most) secrets are never disclosed over LDAP in Active Directory.
    However, due to a design flaw in Samba's implementation of the DirSync control, Active Directory accounts     authorized to do some replication, but not to replicate sensitive attributes, can instead replicate     critical domain passwords and secrets. In a default installation, this means that RODC DC accounts (which     should only be permitted to replicate some passwords) can instead obtain all domain secrets, including the     core AD secret: the krbtgt password. RODCs are given this permission as part of their installation for DRS     replication. This vulnerability removes the RODC / DC distinction. Secondly, and just as problematically,     the access check for this functionality did not account for error conditions - errors like out of memory     were regarded as success. This is sometimes described as fail open. In these error conditions, some of     which (eg out of memory) may be influenced by a low-privileged attacker, access to the secret attributes     could be obtained! (CVE-2023-4154)

  - Samba developers have built a non-Windows RPC server known as rpcecho to test elements of the Samba     DCE/RPC stack under their full control. One RPC function provided by rpcecho can block, essentially     indefinitely, and because the rpcecho service is provided from the main RPC task, which has only one     worker, this denies essentially all service on the AD DC. To address this problem, the rpcecho server is     removed from our production binaries and is restricted to selftest builds only. (CVE-2023-42669)

  - Samba as an Active Directory DC operates RPC services from two distinct parts of the codebase. Those     services focused on the AD DC are started in the main samba process, while services focused on the     fileserver and NT4-like DC are started from the new samba-dcerpcd, which is launched on-demand from the     fileserver (smbd) tasks. When starting, samba-dcerpcd must first confirm which services not to provide, so     as to avoid duplicate listeners. The issue in this advisory is that, when Samba's RPC server is under     load, or otherwise not responding, the servers NOT built for the AD DC (eg build instead for the     NT4-emulation classic DCs) can be incorrectly started, and compete to listen on the same unix domain     sockets. This then results in some queries being answered by the AD DC, and some not. This has been seen     in production at multiple sites, as The procedure number is out of range when starting Active Directory     Users and Computers tool, however it can also be triggered maliciously, to prevent service on the AD DC.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6425-1 advisory.

  - The SMB protocol allows opening files where the client requests read-only access, but then implicitly     truncating the opened file if the client specifies a separate OVERWRITE create disposition. This operation     requires write access to the file, and in the default Samba configuration the operating system kernel will     deny access to open a read-only file for read/write (which the truncate operation requires). However, when     Samba has been configured to ignore kernel file system permissions, Samba will truncate a file when the     underlying operating system kernel would deny the operation. Affected Samba configurations are the ones     where kernel file-system permission checks are bypassed, relying on Samba's own permission enforcement.
    The error is that this check is done against the client request for read-only access, and not the     implicitly requested read-write (for truncate) one. The widely used Samba VFS module acl_xattr when     configured with the module configuration parameter acl_xattr:ignore system acls = yes is the only     upstream Samba module that allows this behavior and is the only known method of reproducing this security     flaw. If (as is the default) the module configuration parameter acl_xattr:ignore system acls=no, then     the Samba server is not vulnerable to this attack. (CVE-2023-4091)

  - In normal operation, passwords and (most) secrets are never disclosed over LDAP in Active Directory.
    However, due to a design flaw in Samba's implementation of the DirSync control, Active Directory accounts     authorized to do some replication, but not to replicate sensitive attributes, can instead replicate     critical domain passwords and secrets. In a default installation, this means that RODC DC accounts (which     should only be permitted to replicate some passwords) can instead obtain all domain secrets, including the     core AD secret: the krbtgt password. RODCs are given this permission as part of their installation for DRS     replication. This vulnerability removes the RODC / DC distinction. Secondly, and just as problematically,     the access check for this functionality did not account for error conditions - errors like out of memory     were regarded as success. This is sometimes described as fail open. In these error conditions, some of     which (eg out of memory) may be influenced by a low-privileged attacker, access to the secret attributes     could be obtained! (CVE-2023-4154)

  - Samba developers have built a non-Windows RPC server known as rpcecho to test elements of the Samba     DCE/RPC stack under their full control. One RPC function provided by rpcecho can block, essentially     indefinitely, and because the rpcecho service is provided from the main RPC task, which has only one     worker, this denies essentially all service on the AD DC. To address this problem, the rpcecho server is     removed from our production binaries and is restricted to selftest builds only. (CVE-2023-42669)

  - Samba as an Active Directory DC operates RPC services from two distinct parts of the codebase. Those     services focused on the AD DC are started in the main samba process, while services focused on the     fileserver and NT4-like DC are started from the new samba-dcerpcd, which is launched on-demand from the     fileserver (smbd) tasks. When starting, samba-dcerpcd must first confirm which services not to provide, so     as to avoid duplicate listeners. The issue in this advisory is that, when Samba's RPC server is under     load, or otherwise not responding, the servers NOT built for the AD DC (eg build instead for the     NT4-emulation classic DCs) can be incorrectly started, and compete to listen on the same unix domain     sockets. This then results in some queries being answered by the AD DC, and some not. This has been seen     in production at multiple sites, as The procedure number is out of range when starting Active Directory     Users and Computers tool, however it can also be triggered maliciously, to prevent service on the AD DC.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
190761	GLSA-202402-28 : Samba: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
187054	QNAP QTS / QuTS hero Vulnerabilities in Samba (QSA-23-20)	Nessus	Misc.	critical
185228	Fedora 39 : samba (2023-8c9251e479)	Nessus	Fedora Local Security Checks	critical
183931	Fedora 37 : samba (2023-fff0c857d6)	Nessus	Fedora Local Security Checks	critical
183272	Ubuntu 23.10 : Samba vulnerabilities (USN-6425-3)	Nessus	Ubuntu Local Security Checks	medium
183022	Samba 4.16 < 4.17.12 / 4.18.x < 4.18.8 / 4.19.x < 4.19.1 Multiple Vulnerabilities	Nessus	Misc.	critical
183005	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : samba (SUSE-SU-2023:4046-1)	Nessus	SuSE Local Security Checks	critical
182987	Fedora 38 : samba (2023-7eb8cbf1a5)	Nessus	Fedora Local Security Checks	critical
182941	Debian DSA-5525-1 : samba - security update	Nessus	Debian Local Security Checks	critical
182877	Slackware Linux 15.0 / current samba Multiple Vulnerabilities (SSA:2023-284-03)	Nessus	Slackware Local Security Checks	critical
182845	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Samba vulnerabilities (USN-6425-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2023-42670

medium

Tenable Plugins

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

medium