The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1738833923 advisory.

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module 'acl_xattr' is configured with 'acl_xattr:ignore system     acls = yes'. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6744 advisory.

    - resolves: RHEL-11937       Fix CVE-2023-3961 - smbd must check the pipename
    - resolves: RHEL-11937       Fix CVE-2023-4091 - SMB clients can truncate files

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module 'acl_xattr' is configured with 'acl_xattr:ignore system     acls = yes'. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7464 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: smbd allows client access to unix domain sockets on the file system as root (CVE-2023-3961)

    * samba: SMB clients can truncate files with read-only permissions (CVE-2023-4091)

    * samba: rpcecho development server allows denial of service via sleep() call on AD DC (CVE-2023-42669)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4059-1 advisory.

    - CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. (bsc#1215904)
    - CVE-2023-42669: Fixed a bug in 'rpcecho' development server which allows Denial of Service via sleep()     call on AD DC. (bso#1215905)
    - CVE-2023-4154: Fixed a bug in dirsync which allows SYSTEM access with only 'GUID_DRS_GET_CHANGES' right.
    (bsc#1215908)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-fff0c857d6 advisory.

    Update to 4.17.12 - Security fixes for CVE-2023-3961, CVE-2023-4091, CVE-2023-4154,  CVE-2023-42669 and     CVE-2023-42670

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7345:01 advisory.

    samba: smbd allows client access to unix domain sockets on the file system     as root (CVE-2023-3961)         samba: SMB clients can truncate files with read-only permissions     (CVE-2023-4091)         samba: rpcecho development server allows denial of service via sleep()     call on AD DC (CVE-2023-42669)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0014 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-4091:
    A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes.

    CVE-2023-42669:
    A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions.

    CVE-2023-3961:
    A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence.

    CVE-2023-42670:
    A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task.

    CVE-2023-4154:
    A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.

    CVE-2022-32746:
    A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0343 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 8.8. It addresses 7 CVEs:
    CVE-2022-2127, CVE-2023-34967, CVE-2023-34966, CVE-2023-34968, CVE-2023-3961, and 2 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
352890	AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2025:1738833923)	Nessus	Alma Linux Local Security Checks	9/30/2026	9/30/2026	medium
197227	EulerOS Virtualization 3.0.6.0 : samba (EulerOS-SA-2024-1704)	Nessus	Huawei Local Security Checks	5/17/2024	1/21/2026	medium
185892	Oracle Linux 9 : samba (ELSA-2023-6744)	Nessus	Oracle Linux Local Security Checks	11/16/2023	1/21/2026	critical
188646	EulerOS 2.0 SP9 : samba (EulerOS-SA-2023-3317)	Nessus	Huawei Local Security Checks	1/16/2024	1/21/2026	medium
189664	RHEL 8 : samba (RHSA-2023:7464)	Nessus	Red Hat Local Security Checks	1/26/2024	1/21/2026	critical
183001	SUSE SLED15: ctdb / ctdb-pcp-pmda / libsamba-policy-devel / etc (SUSE-SU-2023:4059-1)	Nessus	SuSE Local Security Checks	10/13/2023	6/26/2026	medium
183931	Fedora 37 : samba (2023-fff0c857d6)	Nessus	Fedora Local Security Checks	10/26/2023	1/21/2026	critical
291960	MiracleLinux 8 : samba-4.18.6-2.el8_9.ML.1 (AXSA:2024-7345:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	critical
239932	TencentOS Server 4: samba (TSSA-2025:0014)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	critical
355005	Rocky Linux 8.8 [CIQ] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (ciqsa-2026_0343)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	critical

Detections

Analytics

Plugins Search

medium

medium

critical

medium

critical

medium

critical

critical

critical

critical