This update for samba fixes the following issues :

CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).

CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).

CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

  - CVE-2020-14383: An authenticated user can crash the     DCE/RPC DNS with easily crafted records (bsc#1177613).

  - CVE-2020-14323: Unprivileged user can crash winbind     (bsc#1173994).

  - CVE-2020-14318: Missing permissions check in SMB1/2/3     ChangeNotify (bsc#1173902).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Multiple vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix.

CVE-2020-1472

Unauthenticated domain controller compromise by subverting Netlogon cryptography. This vulnerability includes both ZeroLogon and non-ZeroLogon variations.

CVE-2020-10704

An unauthorized user can trigger a denial of service via a stack overflow in the AD DC LDAP server.

CVE-2020-10730

NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results.

CVE-2020-10745

Denial of service resulting from abuse of compression of replies to NetBIOS over TCP/IP name resolution and DNS packets causing excessive CPU load on the Samba AD DC.

CVE-2020-10760

The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will cause a use-after-free.

CVE-2020-14303

Denial of service resulting from CPU spin and and inability to process further requests once the AD DC NBT server receives an empty (zero-length) UDP packet to port 137.

CVE-2020-14318

Missing handle permissions check in ChangeNotify

CVE-2020-14323

Unprivileged user can crash winbind via invalid lookupsids DoS

CVE-2020-14383

DNS server crash via invalid records resulting from uninitialized variables

For Debian 9 stretch, these problems have been fixed in version 2:4.5.16+dfsg-1+deb9u3.

We recommend that you upgrade your samba packages.

For the detailed security status of samba please refer to its security tracker page at: https://security-tracker.debian.org/tracker/samba

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323,CVE-2020-14318)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - As Samba internally opens an underlying file system     handle on a directory when a client requests an open,     even for FILE_READ_ATTRIBUTES then if the underlying     file system permissions don&#39t allow &quotr&quot     (read) access for the connected user, then the handle     open request will be denied.&quot(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1647 advisory.

  - samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

  - samba: Unprivileged user can crash winbind (CVE-2020-14323)

  - samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability. (CVE-2020-10730)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability. (CVE-2020-10745)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba. (CVE-2020-10760)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash. (CVE-2020-14303)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'. (CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_1647 advisory.

    * samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

    * samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

    * samba: Unprivileged user can crash winbind (CVE-2020-14323)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
143847	SUSE SLES12 Security Update : samba (SUSE-SU-2020:3082-1)	Nessus	SuSE Local Security Checks	12/9/2020	1/13/2021	medium
142540	openSUSE Security Update : samba (openSUSE-2020-1811)	Nessus	SuSE Local Security Checks	11/6/2020	12/8/2020	medium
143186	Debian DLA-2463-1 : samba security update	Nessus	Debian Local Security Checks	11/23/2020	1/12/2026	medium
144739	EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2021-1050)	Nessus	Huawei Local Security Checks	1/5/2021	1/12/2026	medium
147047	EulerOS Virtualization for ARM 64 3.0.6.0 : samba (EulerOS-SA-2021-1533)	Nessus	Huawei Local Security Checks	3/4/2021	1/12/2026	medium
147666	EulerOS Virtualization 2.9.0 : samba (EulerOS-SA-2021-1635)	Nessus	Huawei Local Security Checks	3/11/2021	1/12/2026	medium
149752	CentOS 8 : samba (CESA-2021:1647)	Nessus	CentOS Local Security Checks	5/19/2021	1/12/2026	medium
151396	EulerOS Virtualization 3.0.2.2 : samba (EulerOS-SA-2021-2168)	Nessus	Huawei Local Security Checks	7/6/2021	1/12/2026	medium
357993	Rocky Linux 8 [CIQ] Security Update: ctdb / ctdb-debuginfo / ctdb-tests / ctdb-tests-debuginfo / etc Multiple Vulnerabilities (crlsa-2021_1647)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/2/2026	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

critical