New samba packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2790 advisory.

    [4.6.2-11]
    - resolves: #1491213 - CVE-2017-12150 CVE-2017-12151 CVE-2017-12163

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for samba fixes several issues. These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624)

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes several issues. These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624).

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

Security issues fixed :

  - CVE-2017-14746: Use-after-free vulnerability     (bsc#1060427).

  - CVE-2017-15275: Server heap memory information leak     (bsc#1063008).

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file (bsc#1058624).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

  - CVE-2017-12150: Some code path don't enforce smb signing     when they should (bsc#1058565).

Bug fixes :

  - Samba was updated to 4.6.9 (bsc#1065066) see release     notes for details.

  - https://www.samba.org/samba/history/samba-4.6.9.html

This update was imported from the SUSE:SLE-12-SP3:Update update project.

Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2304:03 advisory.

    * It was found that samba did not enforce SMB signing when certain configuration options were enabled. A     remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
    (CVE-2017-12150)
      * An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious     client could use this flaw to dump server memory contents to a file on the samba share or to a shared     printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)     Asianux would like to thank the Samba project for reporting CVE-2017-12150 and     Yihan Lian and Zhibin Hu (Qihoo 360 GearTeam), Stefan Metzmacher (SerNet), and     Jeremy Allison (Google) for reporting CVE-2017-12163. Upstream acknowledges     Stefan Metzmacher (SerNet) as the original reporter of CVE-2017-12150.
    CVE-2017-12150
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-12163
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
103361	Slackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2017-263-01)	Nessus	Slackware Local Security Checks	9/21/2017	11/20/2025	high
103490	Oracle Linux 7 : samba (ELSA-2017-2790)	Nessus	Oracle Linux Local Security Checks	9/27/2017	11/20/2025	high
103832	SUSE SLES11 Security Update : samba (SUSE-SU-2017:2715-1)	Nessus	SuSE Local Security Checks	10/13/2017	11/18/2025	high
104529	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:2971-1)	Nessus	SuSE Local Security Checks	11/13/2017	11/14/2025	high
105218	openSUSE Security Update : samba (openSUSE-2017-1316)	Nessus	SuSE Local Security Checks	12/14/2017	11/12/2025	critical
105999	Fedora 27 : 2:samba (2017-f0c18420e8)	Nessus	Fedora Local Security Checks	1/15/2018	11/4/2025	high
289896	MiracleLinux 4 : samba4-4.2.10-11.AXS4 (AXSA:2017-2304:03)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

high

high