Samba 4.4.x < 4.4.15 / 4.5.x < 4.5.12 / 4.6.x < 4.6.6 KDC-REP Service Name Validation (Orpheus' Lyre)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote Samba server is affected by a service impersonation
vulnerability.

Description :

The version of Samba running on the remote host is 4.4.x prior to
4.4.15, 4.5.x prior to 4.5.12, or 4.6.x prior to 4.6.6. It is,
therefore, affected by a logic flaw in the Heimdal implementation of
Kerberos, specifically within the _krb5_extract_ticket() function
within lib/krb5/ticket.c, due to the unsafe use of cleartext metadata
from an unauthenticated ticket instead of the encrypted version stored
in the Key Distribution Center (KDC) response. A man-in-the-middle
attacker can exploit this issue to impersonate Kerberos services. This
can potentially result in a privilege escalation or the theft of
credentials. Note that Samba versions built against MIT Kerberos are
not impacted by this issue.

Note that Nessus has not tested for this issue but has instead relied
only on the application's self-reported version number.

See also :

https://www.samba.org/samba/security/CVE-2017-11103.html
https://www.samba.org/samba/history/samba-4.4.15.html
https://www.samba.org/samba/history/samba-4.5.12.html
https://www.samba.org/samba/history/samba-4.6.6.html
https://www.orpheus-lyre.info/

Solution :

Upgrade to Samba version 4.4.15 / 4.5.12 / 4.6.6 or later.

Alternatively, if you are not running Samba as an Active Directory
domain controller, as a workaround, you can rebuild Samba using the
following command : ./configure --with-system-mitkrb5.

Risk factor :

Medium / CVSS Base Score : 5.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS Temporal Score : 4.3
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Misc.

Nessus Plugin ID: 101773 ()

Bugtraq ID: 99551

CVE ID: CVE-2017-11103

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now