Samba < 3.5.22 / 3.6.17 / 4.0.8 Denial of Service Vulnerability

Low Nessus Network Monitor Plugin ID 6965

Synopsis

The remote Samba server is affected by a remote denial of service vulnerability in authenticated or guest connections.

Description

According to its banner, the version of Samba running on the remote host may contain a vulnerability wherein a malformed packet can cause the smbd server to go into an infinite loop, denying service to legitimate users.

Solution

Install the patch referenced in the project's advisory, or upgrade to 3.5.22 / 3.6.17 / 4.0.8 or later.

See Also

http://www.samba.org/samba/history/samba-3.5.22.html

http://www.samba.org/samba/history/samba-3.6.17.html

http://www.samba.org/samba/history/samba-4.0.8.html

http://www.samba.org/samba/security/CVE-2013-4124

Plugin Details

Severity: Low

ID: 6965

File Name: 6965.prm

Family: Samba

Published: 2013/08/07

Modified: 2016/02/05

Dependencies: 8740, 8741

Nessus ID: 69276

Risk Information

Risk Factor: Low

CVSSv2

Base Score: 3.6

Temporal Score: 3

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 5

Temporal Score: 4.6

Vector: CVSS3#AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:samba:samba

Patch Publication Date: 2013/08/05

Vulnerability Publication Date: 2013/08/05

Reference Information

CVE: CVE-2013-4124

BID: 61597

OSVDB: 95969