Samba 4.x < 4.1.22 Multiple Vulnerabilities
Medium Nessus Plugin ID 87768
SynopsisThe remote Samba server is affected by multiple vulnerabilities.
DescriptionAccording to its banner, the version of Samba running on the remote host is 4.x prior to 4.1.22. It is, therefore, affected by the following vulnerabilities :
- A denial of service vulnerability exists in the ldb_wildcard_compare() function in file ldb_match.c due to mishandling certain zero values. An unauthenticated, remote attacker can exploit this, via crafted LDAP requests, to exhaust CPU resources. (CVE-2015-3223)
- A security bypass vulnerability exists in the check_reduced_name_with_privilege() function and the check_reduced_name() function within file smbd/vfs.c that allows users to follow symlinks that point to resources in another directory that shares a common path prefix. An unauthenticated, remote attacker can exploit this, via a symlink that points outside of a share, to bypass file access restrictions. (CVE-2015-5252)
- A flaw exists due to a failure to ensure that signing is negotiated when creating encrypted connections between the client and server. A man-in-the-middle attacker can exploit this, by modifying the client-server data stream, to downgrade the security of the connection, thus allowing communications to be monitored or manipulated. (CVE-2015-5296)
- A security bypass vulnerability exists in the shadow_copy2_get_shadow_copy_data() function in file modules/vfs_shadow_copy2.c due to a failure to verify that DIRECTORY_LIST access rights has been granted when accessing snapshots. An unauthenticated, remote attacker can exploit this to access snapshots by visiting a shadow copy directory. (CVE-2015-5299)
- A flaw exists in the LDAP server due to improper handling of string lengths in LDAP requests. An unauthenticated, remote attacker can exploit this to gain sensitive information from the daemon heap memory by sending crafted packets and then reading an error message or a database value. (CVE-2015-5330)
- A denial of service vulnerability exists in the LDAP server due to a failure to check return values when allocating ASN.1 memory. An unauthenticated, remote attacker can exploit this, via crafted packets, to cause the daemon to crash through memory consumption.
- The samldb_check_user_account_control_acl() function in file dsdb/samdb/ldb_modules/samldb.c fails to properly check for administrative privileges during the creation of machine accounts. An authenticated, remote attacker can exploit this to bypass intended access restrictions by making use of a domain that has both a Samba DC and Windows DC. (CVE-2015-8467)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
SolutionUpgrade to Samba version 4.1.22 or greater.