Samba 4.x < 4.1.22 Multiple Vulnerabilities

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Samba server is affected by multiple vulnerabilities.

Description :

According to its banner, the version of Samba running on the remote
host is 4.x prior to 4.1.22. It is, therefore, affected by the
following vulnerabilities :

- A denial of service vulnerability exists in the
ldb_wildcard_compare() function in file ldb_match.c due
to mishandling certain zero values. An unauthenticated,
remote attacker can exploit this, via crafted LDAP
requests, to exhaust CPU resources. (CVE-2015-3223)

- A security bypass vulnerability exists in the
check_reduced_name_with_privilege() function and the
check_reduced_name() function within file smbd/vfs.c
that allows users to follow symlinks that point to
resources in another directory that shares a common path
prefix. An unauthenticated, remote attacker can exploit
this, via a symlink that points outside of a share, to
bypass file access restrictions. (CVE-2015-5252)

- A flaw exists due to a failure to ensure that signing is
negotiated when creating encrypted connections between
the client and server. A man-in-the-middle attacker can
exploit this, by modifying the client-server data
stream, to downgrade the security of the connection,
thus allowing communications to be monitored or
manipulated. (CVE-2015-5296)

- A security bypass vulnerability exists in the
shadow_copy2_get_shadow_copy_data() function in file
modules/vfs_shadow_copy2.c due to a failure to verify
that DIRECTORY_LIST access rights has been granted when
accessing snapshots. An unauthenticated, remote attacker
can exploit this to access snapshots by visiting a
shadow copy directory. (CVE-2015-5299)

- A flaw exists in the LDAP server due to improper
handling of string lengths in LDAP requests. An
unauthenticated, remote attacker can exploit this to
gain sensitive information from the daemon heap memory
by sending crafted packets and then reading an error
message or a database value. (CVE-2015-5330)

- A denial of service vulnerability exists in the LDAP
server due to a failure to check return values when
allocating ASN.1 memory. An unauthenticated, remote
attacker can exploit this, via crafted packets, to
cause the daemon to crash through memory consumption.
(CVE-2015-7540)

- The samldb_check_user_account_control_acl() function
in file dsdb/samdb/ldb_modules/samldb.c fails to
properly check for administrative privileges during the
creation of machine accounts. An authenticated, remote
attacker can exploit this to bypass intended access
restrictions by making use of a domain that has both
a Samba DC and Windows DC. (CVE-2015-8467)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.

See also :

https://www.samba.org/samba/security/CVE-2015-3223.html
https://www.samba.org/samba/security/CVE-2015-5252.html
https://www.samba.org/samba/security/CVE-2015-5296.html
https://www.samba.org/samba/security/CVE-2015-5299.html
https://www.samba.org/samba/security/CVE-2015-5330.html
https://www.samba.org/samba/security/CVE-2015-7540.html
https://www.samba.org/samba/security/CVE-2015-8467.html
http://www.samba.org/samba/history/samba-4.1.22.html

Solution :

Upgrade to Samba version 4.1.22 or greater.

Risk factor :

Medium / CVSS Base Score : 6.0
(CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS Temporal Score : 4.4
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now