According to its banner, the version of Samba server on the remote host is potentially affected by multiple vulnerabilities : 

  - If a user in '/etc/passwd' is misconfigured to have an empty home directory then connecting to the home share of this user will use the root of the filesystem as the home directory. (CVE-2009-2813)

  - Specially crafted SMB requests on authenticated SMB connections can send smbd into a 100% loop, causing a denial of service. (CVE-2009-2906)

  - When 'mount.cifs' is installed as a setuid program, a user can pass it a credential or password path to which he or she does not have access and then use the '--verbose' option to view the first line of that file. (CVE-2009-2948)

The remote server is hosting the indicated file.

According to its banner, the version of the Samba server on the remote host is between 3.2.0 and 3.2.6 inclusive.  Such versions reportedly allow an authenticated remote user to gain access to the root filesystem, subject to his or her privileges, by making a request for a share called '' (empty string) from a version of smbclient prior to 3.0.28.  Successful exploitation of this issue requires 'registry shares' to be enabled, which is not enabled by default.

According to its banner, the version of the Samba server on the remote host is between 3.0.29 and 3.2.4 inclusive.  Such versions reportedly can potentially leak arbitrary memory contents of the 'smbd' process due to a missing bounds check on client-generated offsets of secondary 'trans', 'trans2', and 'nttrans' requests. 

According to its banner, the version of the Samba server on the remote host is reportedly affected by a boundary error in 'nmbd' within the 'receive_smb_raw' function in 'lib/util_sock.c' when parsing SMB packets received in a client context.  By sending specially-crafted packets to an 'nmbd' server configured as a local or domain master browser, an attacker can leverage this issue to produce a heap-based buffer overflow and execute arbitrary code with system privileges.

 According to its banner, the version of the Samba server on the remote host is reportedly affected by a boundary error in 'nmbd' within the 'send_mailslot' function.  Provided the 'domain logons' option is enabled in 'smb.conf', an attacker can leverage this issue to produce a stack-based buffer overflow using a 'SAMLOGON' domain logon packet in which the username string is placed at an odd offset and is followed by a long 'GETDC' string.  Note that NNM has not verified whether 'domain logons' are enabled on the remote host.

 According to its banner, the version of the Samba server on the remote host contains a boundary error in the 'reply_netbios_packet()' function in 'nmbd/nmbd_packets.c' when sending NetBIOS replies.  Provided the server is configured to run as a WINS server, a remote attacker can exploit this issue by sending multiple specially-crafted WINS 'Name Registration' requests followed by a WINS 'Name Query' request, leading to a stack-based buffer overflow and allow for execution of arbitrary code.
There is also a stack buffer overflow in nmbd's logon request processing code that can be triggered by means of specially-crafted GETDC mailslot requests when the affected server is configured as a Primary or Backup Domain Controller.  The Samba security team currently does not believe this particular vulnerability can be exploited to execute arbitrary code remotely.

According to its banner, the version of the Samba server installed on the remote host is affected by a flaw where a local attacker can gain group-0 access.  In order for the exploit to work, the local system must be configured to use Microsoft Active Directory and return a NULL value for the group ID.  Successful exploitation would result in the local attacker gaining elevated access on the local machine.

According to its banner, the version of the Samba server installed on the remote host is affected by multiple buffer overflow and remote command injection vulnerabilities that can be exploited remotely, as well as a local privilege escalation bug. 

The version of the Samba server installed on the remote host is affected by multiple heap overflow vulnerabilities that can be exploited remotely to execute code with the privileges of the samba daemon.

The remote Samba server, according to its version number, may be vulnerable to multiple remote buffer overflows.   The flaw appears to be in the way that Samba handles very long responses to 'gethostbyname' and 'getipnodebyname' name resolution.  An attacker exploiting this flaw would only need to be able to send a very long name to the vulnerable application.  Successful exploitation would result in the attacker executing arbitrary code on the Samba server. 

The remote Samba server, according to its version number, may be vulnerable to a remote attack.  An attacker can cause the Samba smbd service to fail by opening a large number of connections.  Successful exploitation leads to a loss of availability. 

The remote Samba server, according to its version number, may be vulnerable to a local flaw.  Specifically, if debugging has been set to level 5 or higher, the local SAMBA process will log account credentials.  These credentials can be read by local users and used in future attacks.

The remote Samba server, according to its version number, may be vulnerable to a remote buffer overflow.
The remote integer overflow vulnerability may allow an attacker to execute code on the server.
 An attacker needs access to a vulnerable share to exploit this issue.

The remote Samba server, according to its version number, may be vulnerable to a remote Denial Of Service vulnerability and a remote buffer overflow.
 The Wild Card DoS vulnerability may allow an attacker to make the remote server consume excessive CPU cycles.
The QFILEPATHINFO remote buffer overflow vulnerability may allow an attacker to execute code on the server.
 An attacker needs credentials to exploit those flaws. 

The remote Samba server, according to its version number, may be vulnerable to a remote file access vulnerability.
 This vulnerability may allow an attacker to access arbitrary files that exist outside of the share's defined path.
An attacker needs a valid account to exploit this vulnerability. 

The remote Samba server is vulnerable to a buffer overflow when a client requests a password change. An attacker may use it to cause a denial of service or execute arbitrary code on this host with root privileges 

The remote Samba server is vulnerable to a buffer overflow when it processes the function trans2open().  An attacker may exploit it to gain a root shell on this host.

The remote Samba-TNG server is vulnerable to multiple flaws that may let an attacker gain a root shell on this host.  As the version number did not change with the update, this alert might be a false positive 

The remote Samba server is vulnerable to an unspecified buffer overflow, whose implications are not clear at this time. 

The remote Samba server is vulnerable to a remote buffer overflow when receiving specially crafted SMB/CIFS packets. To exploit this flaw, an attacker would need to be able to access at least one share and send a specially formated packet which would execute arbitrary code on the remote host.

According to its banner, the version of the Samba server on the remote host has a security bypass vulnerability. Access restrictions can be bypassed due to a read of uninitialized data in smbd. This could allow a user to modify an access control list (ACL), even when they should be denied permission.

Note the 'dos filemode' parameter must be set to 'yes' in smb.conf in order for an attack to be successful (the default setting is 'no').

ID	Name	Severity
5194	Samba < 3.0.37 / 3.2.15 / 3.3.8 / 3.4.2 Multiple Vulnerabilities	medium
5054	SMB AndX File Handle Detection (server)	info
4807	Samba 3.2.0 - 3.2.6 Unauthorized Access	medium
4774	Samba 3.0.29 - 3.2.4 Potential Memory Disclosure	medium
4522	Samba < 3.0.30 'receive_smb_raw' Buffer Overflow Vulnerability	high
4311	Samba < 3.0.28 'send_mailslot' Function Buffer Overflow	critical
4285	Samba < 3.0.27 Multiple Vulnerabilities	critical
4208	Samba < 3.0.26 'idmap_ad.co' Local Privilege Escalation	low
3990	Samba < 3.0.25 Multiple Vulnerabilities	high
3988	Samba < 3.0.25 NDR MS-RPC Request Heap-Based Overflow	medium
3905	Samba < 3.0.24 'nss_winbind.so.1' Multiple Function Overflow	medium
3682	Samba < 3.0.23 smdb Share Remote DoS	medium
3499	Samba < 3.0.22 Local File Permissions Credentials Disclosure	low
1337	Samba Detection	info
2463	Samba < 3.0.10 Directory Access Control List Remote Integer Overflow	critical
2397	Samba < 3.0.8 Remote Wild Card DoS and QFILEPATHINFO Remote Overflow	high
2338	Samba < 3.0.6 Remote Arbitrary File Access	medium
2337	Samba < 2.2.11 Remote Arbitrary File Access	medium
1343	Samba < 2.2.7 Unicode Encrypted Password Decryption Overflow	critical
1342	Samba < 2.2.8a 'trans2.c trans2open()' Function Overflow	critical
1341	Samba-TNG < 0.3.1 Multiple Vulnerabilities (deprecated)	high
1340	Samba < 2.2.5 Multiple Overflows	high
1339	Samba < 2.2.8 Fragment Reassembly Overflow / Arbitrary File Overwrite	high
5087	Samba < 3.3.6 / 3.2.13 / 3.0.35 Multiple Vulnerabilities	high

Detections

Analytics

Samba Family for Nessus Network Monitor

medium

info

medium

medium

high

critical

critical

low

high

medium

medium

medium

low

info

critical

high

medium

medium

critical

critical

high

high

high

high