Debian DLA-2463-1 : samba security update

critical Nessus Plugin ID 143186
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Debian host is missing a security update.

Description

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix.

CVE-2020-1472

Unauthenticated domain controller compromise by subverting Netlogon cryptography. This vulnerability includes both ZeroLogon and non-ZeroLogon variations.

CVE-2020-10704

An unauthorized user can trigger a denial of service via a stack overflow in the AD DC LDAP server.

CVE-2020-10730

NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results.

CVE-2020-10745

Denial of service resulting from abuse of compression of replies to NetBIOS over TCP/IP name resolution and DNS packets causing excessive CPU load on the Samba AD DC.

CVE-2020-10760

The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will cause a use-after-free.

CVE-2020-14303

Denial of service resulting from CPU spin and and inability to process further requests once the AD DC NBT server receives an empty (zero-length) UDP packet to port 137.

CVE-2020-14318

Missing handle permissions check in ChangeNotify

CVE-2020-14323

Unprivileged user can crash winbind via invalid lookupsids DoS

CVE-2020-14383

DNS server crash via invalid records resulting from uninitialized variables

For Debian 9 stretch, these problems have been fixed in version 2:4.5.16+dfsg-1+deb9u3.

We recommend that you upgrade your samba packages.

For the detailed security status of samba please refer to its security tracker page at: https://security-tracker.debian.org/tracker/samba

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Upgrade the affected packages.

See Also

https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html

https://packages.debian.org/source/stretch/samba

https://security-tracker.debian.org/tracker/source-package/samba

Plugin Details

Severity: Critical

ID: 143186

File Name: debian_DLA-2463.nasl

Version: 1.2

Type: local

Agent: unix

Published: 11/23/2020

Updated: 11/25/2020

Dependencies: ssh_get_info.nasl

Risk Information

CVSS Score Source: CVE-2020-1472

VPR

Risk Factor: Critical

Score: 10

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:H/RL:OF/RC:C

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:ctdb, p-cpe:/a:debian:debian_linux:libnss-winbind, p-cpe:/a:debian:debian_linux:libpam-winbind, p-cpe:/a:debian:debian_linux:libparse-pidl-perl, p-cpe:/a:debian:debian_linux:libsmbclient, p-cpe:/a:debian:debian_linux:libsmbclient-dev, p-cpe:/a:debian:debian_linux:libwbclient-dev, p-cpe:/a:debian:debian_linux:libwbclient0, p-cpe:/a:debian:debian_linux:python-samba, p-cpe:/a:debian:debian_linux:registry-tools, p-cpe:/a:debian:debian_linux:samba, p-cpe:/a:debian:debian_linux:samba-common, p-cpe:/a:debian:debian_linux:samba-common-bin, p-cpe:/a:debian:debian_linux:samba-dev, p-cpe:/a:debian:debian_linux:samba-dsdb-modules, p-cpe:/a:debian:debian_linux:samba-libs, p-cpe:/a:debian:debian_linux:samba-testsuite, p-cpe:/a:debian:debian_linux:samba-vfs-modules, p-cpe:/a:debian:debian_linux:smbclient, p-cpe:/a:debian:debian_linux:winbind, cpe:/o:debian:debian_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/22/2020

Vulnerability Publication Date: 5/6/2020

Reference Information

CVE: CVE-2020-10704, CVE-2020-10730, CVE-2020-10745, CVE-2020-10760, CVE-2020-14303, CVE-2020-14318, CVE-2020-14323, CVE-2020-14383, CVE-2020-1472