The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-5192 advisory.

    - resolves: #2019661 - Fix CVE-2016-2124
    - resolves: #2019673 - Fix CVE-2020-25717

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3563 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3563-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Lee Garrett     September 12, 2023                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : samba     Version        : 2:4.9.5+dfsg-5+deb10u4     CVE ID         : CVE-2016-2124 CVE-2019-10218 CVE-2019-14833 CVE-2019-14847                      CVE-2019-14902 CVE-2019-14907 CVE-2019-19344     Debian Bug     :

    Several vulnerabilities were discovered in Samba, the SMB/CIFS file, print, and     login server for Unix.

    CVE-2016-2124

        A flaw was found in the way samba implemented SMB1 authentication. An         attacker could use this flaw to retrieve the plaintext password sent over         the wire even if Kerberos authentication was required.

    CVE-2019-10218

        A flaw was found in the samba client, all samba versions before samba         4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname         to the client with separators. This could allow the client to access files         and folders outside of the SMB network pathnames. An attacker could use this         vulnerability to create files outside of the current working directory using         the privileges of the client user.

    CVE-2019-14833

        A flaw was found in Samba, all versions starting samba 4.5.0 before samba         4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password         change or a new password for a samba user. The Samba Active Directory Domain         Controller can be configured to use a custom script to check for password         complexity. This configuration can fail to verify password complexity when         non-ASCII characters are used in the password, which could lead to weak         passwords being set for samba users, making it vulnerable to dictionary         attacks.

    CVE-2019-14847

        A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before         4.10.10. An attacker can crash AD DC LDAP server via dirsync resulting in         denial of service. Privilege escalation is not possible with this issue.

    CVE-2019-14902

        There is an issue in all samba 4.11.x versions before 4.11.5, all samba         4.10.x versions before 4.10.12 and all samba 4.9.x versions before 4.9.18,         where the removal of the right to create or modify a subtree would not         automatically be taken away on all domain controllers.

    CVE-2019-14907

        All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x         before 4.11.5 have an issue where if it is set with log level = 3 (or         above) then the string obtained from the client, after a failed character         conversion, is printed. Such strings can be provided during the NTLMSSP         authentication exchange. In the Samba AD DC in particular, this may cause a         long-lived process(such as the RPC server) to terminate. (In the file server         case, the most likely target, smbd, operates as process-per-client and so a         crash there is harmless).

    CVE-2019-19344

        There is a use-after-free issue in all samba 4.9.x versions before 4.9.18,         all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions         before 4.11.5, essentially due to a call to realloc() while other local         variables still point at the original buffer.

    For Debian 10 buster, these problems have been fixed in version     2:4.9.5+dfsg-5+deb10u4.

    We recommend that you upgrade your samba packages.

    Admins of AD DC setups are reminded and strongly encouraged to upgrade to     bullseye and then bookworm, as AD DC setups are unsupported in buster since [DSA     5015-1], and in bullseye since [DSA 5477-1].

    [DSA 5015-1] https://www.debian.org/security/2021/dsa-5015     [DSA 5477-1] https://www.debian.org/security/2023/dsa-5477


    For the detailed security status of samba please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2787:06 advisory.

    * samba: Active Directory (AD) domain user could become root on domain members (CVE-2020-25717)
      * samba: SMB1 client connections can be downgraded to plaintext authentication (CVE-2016-2124)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.10.16-18. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1746 advisory.

    Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution (CVE-2021-44142)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide '...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver.' Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has samba packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
156156	Oracle Linux 7 : samba (ELSA-2021-5192)	Nessus	Oracle Linux Local Security Checks	12/17/2021	11/1/2024	high
181444	Debian dla-3563 : ctdb - security update	Nessus	Debian Local Security Checks	9/14/2023	1/22/2025	medium
291687	MiracleLinux 7 : samba-4.10.16-17.el7 (AXSA:2021-2787:06)	Nessus	Miracle Linux Local Security Checks	1/19/2026	1/19/2026	high
157885	Amazon Linux 2 : samba (ALAS-2022-1746)	Nessus	Amazon Linux Local Security Checks	2/11/2022	12/11/2024	high
165891	EulerOS Virtualization 3.0.6.6 : samba (EulerOS-SA-2022-2537)	Nessus	Huawei Local Security Checks	10/9/2022	2/3/2023	high
174101	NewStart CGSL CORE 5.05 / MAIN 5.05 : samba Multiple Vulnerabilities (NS-SA-2023-0016)	Nessus	NewStart CGSL Local Security Checks	4/11/2023	4/18/2023	high
158490	EulerOS 2.0 SP5 : samba (EulerOS-SA-2022-1282)	Nessus	Huawei Local Security Checks	3/1/2022	3/1/2022	high

Detections

Analytics

Plugins Search

high

medium

high

high

high

high

high