The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0176 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2016-2124:
    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

    CVE-2020-25717:
    A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation.

    CVE-2021-20316:
    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share.

    CVE-2021-44141:
    All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

    CVE-2021-23192:
    A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data,     bypassing the signature requirements.

    CVE-2022-32742:
    A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:5082 advisory.

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data,     bypassing the signature requirements. (CVE-2021-23192)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end     of the array in the case where a negative cache entry had been added to the mapping cache. This could     cause the calling code to return those values into the process token that stores the group membership for     a user. The highest threat from this vulnerability is to data confidentiality and integrity.
    (CVE-2021-20254)

  - A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data,     bypassing the signature requirements. (CVE-2021-23192)

  - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to     allow a directory to be created in an area of the server file system not exported under the share     definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack     to succeed. (CVE-2021-43566)

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.16.2-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-224 advisory.

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC     (read-only domain controller). This would allow an RODC to print administrator tickets. (CVE-2020-25718)

  - A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise. (CVE-2020-25719)

  - Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now     provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.
    (CVE-2020-25721)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0077 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10197:
    A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to     4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker     could use this flaw to escape the shared directory and access the contents of directories outside the     share.

    CVE-2019-10218:
    A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.

    CVE-2019-14907:
    All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where     if it is set with log level = 3 (or above) then the string obtained from the client, after a failed     character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange.
    In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to     terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a     crash there is harmless).

    CVE-2019-3880:
    A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API.
    An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix     permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6     and 4.10.2 are vulnerable.

    CVE-2020-14318:
    A flaw was found in the way samba handled file and directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory information which otherwise would be unavailable to     the attacker.

    CVE-2020-14323:
    A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of     service.

    CVE-2020-14383:
    A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to     crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short     delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to operate, but many RPC services will not.

    CVE-2020-1472:
    An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.

    CVE-2020-25717:
    A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation.

    CVE-2021-20254:
    A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end     of the array in the case where a negative cache entry had been added to the mapping cache. This could     cause the calling code to return those values into the process token that stores the group membership for     a user. The highest threat from this vulnerability is to data confidentiality and integrity.

    CVE-2021-23192:
    A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data,     bypassing the signature requirements.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0443 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host.
    These packages include redhat-release-virtualization-host. Red Hat     Virtualization Hosts (RHVH) are installed using a special build of Red Hat     Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user     interface for monitoring the host's resources and     performing administrative tasks.

    Security Fix(es):

    * polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector     (CVE-2021-4034)

    * samba: Active Directory (AD) domain user could become root on domain members (CVE-2020-25717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
236698	Alibaba Cloud Linux 3 : 0176: samba (ALINUX3-SA-2022:0176)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
158879	AlmaLinux 8 : samba (ALSA-2021:5082)	Nessus	Alma Linux Local Security Checks	3/12/2022	3/12/2022	high
251719	Linux Distros Unpatched Vulnerability : CVE-2020-25717	Nessus	Misc.	8/19/2025	8/19/2025	high
167474	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2022-0099)	Nessus	NewStart CGSL Local Security Checks	11/15/2022	2/3/2023	high
168583	Amazon Linux 2022 : samba (ALAS2022-2022-224)	Nessus	Amazon Linux Local Security Checks	12/10/2022	12/11/2024	high
236653	Alibaba Cloud Linux 3 : 0077: samba (ALINUX3-SA-2021:0077)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/15/2025	critical
157414	RHEL 7 : RHV-H security update (redhat-virtualization-host) 4.3.21 (Important) (RHSA-2022:0443)	Nessus	Red Hat Local Security Checks	2/8/2022	11/7/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high