Samba 3.x < 3.6.22 / 4.0.x < 4.0.13 / 4.1.x < 4.1.3 Multiple Vulnerabilities

High Nessus Plugin ID 71377


The remote Samba server is affected by multiple vulnerabilities.


According to its banner, the version of Samba running on the remote host is 3.3.x equal or later than 3.3.10, 3.4.x, 3.5.x, 3.6.x prior to 3.6.22, 4.0.x prior to 4.0.13 or 4.1.x prior to 4.1.3. It is, therefore, potentially affected by multiple vulnerabilities :

- A security bypass vulnerability exists in the 'winbind_name_list_to_sid_string_list()' function of the 'nsswitch/pam_winbind.c' source file. Exploitation could allow a malicious, authenticated user access to the 'pam_winbind' configuration file. (CVE-2012-6150)

- A buffer overflow exists in the 'dcerpc_read_ncacn_packet_done' function of the 'librpc/rpc/dcerpc_util.c' source file that could allow remote AD domain controllers to execute arbitrary code on the remote host via DCE-RPC packet with an invalid fragment length. (CVE-2013-4408)

Note that Nessus has relied only on the self-reported version number and has not actually tried to exploit this issue or determine if the associated patch has been applied.


Upgrade to version 3.6.22 / 4.0.13 / 4.1.3 or later or refer to the vendor for a patch or workaround.

See Also

Plugin Details

Severity: High

ID: 71377

File Name: samba_4_1_3.nasl

Version: $Revision: 1.6 $

Type: remote

Family: Misc.

Published: 2013/12/12

Modified: 2018/02/20

Dependencies: 10785

Risk Information

Risk Factor: High


Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:samba:samba

Required KB Items: SMB/NativeLanManager, SMB/samba, Settings/ParanoidReport

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2013/12/09

Vulnerability Publication Date: 2012/06/12

Reference Information

CVE: CVE-2012-6150, CVE-2013-4408

BID: 64101, 64191

OSVDB: 100749, 102653