The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0077 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10197:
    A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and access the contents of directories outside the     share.

    CVE-2019-10218:
    A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.

    CVE-2019-14907:
    All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where     if it is set with log level = 3 (or above) then the string obtained from the client, after a failed     character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange.
    In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to     terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a     crash there is harmless).

    CVE-2019-3880:
    A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API.
    An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix     permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6     and 4.10.2 are vulnerable.

    CVE-2020-14318:
    A flaw was found in the way samba handled file and directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory information which otherwise would be unavailable to     the attacker.

    CVE-2020-14323:
    A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of     service.

    CVE-2020-14383:
    A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to     crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short     delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to operate, but many RPC services will not.

    CVE-2020-1472:
    An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.

    CVE-2020-25717:
    A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation.

    CVE-2021-20254:
    A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end     of the array in the case where a negative cache entry had been added to the mapping cache. This could     cause the calling code to return those values into the process token that stores the group membership for     a user. The highest threat from this vulnerability is to data confidentiality and integrity.

    CVE-2021-23192:
    A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data,     bypassing the signature requirements.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Alibaba Cloud Linux 3 : 0077: samba (ALINUX3-SA-2021:0077)

critical Nessus Plugin ID 236653

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Dec 18, 2025, 1:27 AM CISA reference Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202512180127
Version 1.2 May 16, 2025, 5:21 AM CEA reference Plugin Feed: 202505160521
Version 1.1 May 15, 2025, 5:17 AM New Plugin Feed: 202505150517