Samba 3.5.x < 4.4 / 4.4.x < 4.4.14 / 4.5.x < 4.5.10 / 4.6.x < 4.6.4 Shared Library RCE
High Nessus Plugin ID 100388
Synopsis
The remote Samba server is affected by a remote code execution vulnerability.
Description
The version of Samba running on the remote host is 3.5.x prior to 4.4.x, or it is 4.4.x prior to 4.4.14, 4.5.x prior to 4.5.10, or 4.6.x prior to 4.6.4. It is, therefore, affected by an unspecified remote code execution vulnerability. An authenticated, remote attacker can exploit this, via a specially crafted shared library uploaded to a writable share, to cause the server to load and execute arbitrary code with root privileges.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Samba version 4.4.14 / 4.5.10 / 4.6.4 or later.
Alternatively, add the parameter 'nt pipe support = no' to the [global] section of the smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note that this workaround can disable some expected functionality for Windows clients.