The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0449 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) or     Common Internet File System (CIFS) protocol, which allows PC-compatible     machines to share files, printers, and other information.

    A flaw was found in the way Samba handled ACLs on symbolic links.
    An authenticated user could use this flaw to gain access to an arbitrary     file or directory by overwriting its ACL. (CVE-2015-7560)

    Red Hat would like to thank the Samba project for reporting this issue.
    Upstream acknowledges Jeremy Allison (Google) and the Samba team as the     original reporters.

    All samba4 users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing this     update, the smb service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0447 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) or     Common Internet File System (CIFS) protocol, which allows PC-compatible     machines to share files, printers, and other information.

    A flaw was found in the way Samba handled ACLs on symbolic links.
    An authenticated user could use this flaw to gain access to an arbitrary     file or directory by overwriting its ACL. (CVE-2015-7560)

    Red Hat would like to thank the Samba project for reporting this issue.
    Upstream acknowledges Jeremy Allison (Google) and the Samba team as the     original reporters.

    This update also fixes the following bug:

    * Under a high load, the vfs_glusterfs AIO code would hit a use-after-free     error and cause a crash. This update fixes the affected code, and crashes     no longer occur. (BZ #1315736)

    All samba users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing this     update, the smb service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was found in the way Samba handled ACLs on symbolic links. An authenticated user could use this flaw to gain access to an arbitrary file or directory by overwriting its ACL.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before     4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a     UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.
    (CVE-2015-7560)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes these security vulnerabilities :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2114: 'server signing = mandatory' not enforced     (bsc#973035).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

The openSUSE 13.1 update also upgrades to samba 4.2.4 as 4.1.x versions are no longer supported by upstream. As a side effect, libpdb0 package was replaced by libsamba-passdb0.

ID	Name	Product	Family	Published	Updated	Severity
89955	RHEL 6 : samba4 (RHSA-2016:0449)	Nessus	Red Hat Local Security Checks	3/16/2016	4/15/2025	medium
89983	RHEL 6 / 7 : samba (RHSA-2016:0447)	Nessus	Red Hat Local Security Checks	3/17/2016	6/3/2024	medium
90267	Amazon Linux AMI : samba (ALAS-2016-674)	Nessus	Amazon Linux Local Security Checks	4/1/2016	4/18/2018	medium
219017	Linux Distros Unpatched Vulnerability : CVE-2015-7560	Nessus	Misc.	3/4/2025	3/4/2025	medium
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	9/10/2024	9/17/2024	critical
90609	openSUSE Security Update : samba (openSUSE-2016-490) (Badlock)	Nessus	SuSE Local Security Checks	4/21/2016	1/19/2021	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical

high