According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way Samba handled dangling     symlinks. An authenticated malicious Samba client could     use this flaw to cause the smbd daemon to enter an     infinite loop and use an excessive amount of CPU and     memory. (CVE-2017-9461)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Samba incorrectly handled dangling symlinks. A remote attacker could possibly use this issue to cause Samba to hang, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-9461)

In addition, this update fixes a regression introduced by USN-3267-1 that caused Samba to incorrectly handle non-wide symlinks to directories.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version:
samba (4.6.2). (BZ#1391954)

Security Fix(es) :

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
samba (4.6.2).

Security Fix(es) :

  - A flaw was found in the way Samba handled dangling     symlinks. An authenticated malicious Samba client could     use this flaw to cause the smbd daemon to enter an     infinite loop and use an excessive amount of CPU and     memory. (CVE-2017-9461)

An update for samba is now available for Red Hat Gluster Storage 3.2 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions.
(CVE-2017-2619)

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - samba: Active Directory (AD) domain user could become root on domain members (CVE-2020-25717)

  - samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023)

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption     with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to     any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-     middle attack. (CVE-2017-12151)

  - Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of     the server to clear allocated heap memory. (CVE-2017-15275)

  - smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic     infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
    (CVE-2017-9461)

  - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.
    (CVE-2019-10218)

  - A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API.
    An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix     permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6     and 4.10.2 are vulnerable. (CVE-2019-3880)

  - A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package.
    This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference.
    The highest threat from this vulnerability is to system availability. (CVE-2020-10730)

  - A flaw was found in the way samba handled file and directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory information which otherwise would be unavailable to     the attacker. (CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of     service. (CVE-2020-14323)

  - A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end     of the array in the case where a negative cache entry had been added to the mapping cache. This could     cause the calling code to return those values into the process token that stores the group membership for     a user. The highest threat from this vulnerability is to data confidentiality and integrity.
    (CVE-2021-20254)

  - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to     an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The     highest threat from this vulnerability is to system availability. (CVE-2021-20277)

  - A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

  - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to     allow a directory to be created in an area of the server file system not exported under the share     definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack     to succeed. (CVE-2021-43566)

  - In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. (CVE-2022-1615)

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer). (CVE-2022-32742)

  - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl. (CVE-2022-32746)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

From Red Hat Security Advisory 2017:1950 :

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version:
samba (4.6.2). (BZ#1391954)

Security Fix(es) :

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

An update for samba is now available for Red Hat Gluster Storage 3.3 for RHEL 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories in areas of the server file system not exported under the share definitions.
(CVE-2017-2619)

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.

Bug Fix(es) :

* In the samba configuration, by default the 'posix locking' is enabled and 'stat cache' is disabled. Enabling 'posix locking' sends the file lock request to the bricks too, and disabling 'stat cache' blocks samba to cache certain information at the samba layer. This led to decrease in performance of SMB access of Red Hat Gluster Storage volumes

As a fix, the following two options are included in the samba configuration file: posix locking = No stat cache = Yes

Due to this, a slight improvement in the performance is observed.
(BZ#1436265)

Various vulnerabilities were discovered in Samba, SMB/CIFS file, print, and login server/client for Unix

CVE-2017-9461

smbd in Samba had a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

CVE-2018-1050

Samba was vulnerable to a denial of service attack when the RPC spoolss service was configured to be run as an external daemon.
Missing input sanitization checks on some of the input parameters to spoolss RPC calls could have caused the print spooler service to crash.

CVE-2018-1057

On a Samba 4 AD DC the LDAP server of Samba incorrectly validated permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Thanks to the Ubuntu security team for having backported the rather invasive changeset to Samba in Ubuntu 14.04 (which we could use to patch Samba in Debian jessie LTS).

CVE-2019-3880

A flaw was found in the way Samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could have used this flaw to create a new registry hive file anywhere they had unix permissions which could have lead to creation of a new file in the Samba share.

For Debian 8 'Jessie', these problems have been fixed in version 2:4.2.14+dfsg-0+deb8u12.

We recommend that you upgrade your samba packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
103077	EulerOS 2.0 SP1 : samba (EulerOS-SA-2017-1219)	Nessus	Huawei Local Security Checks	9/11/2017	1/6/2021	medium
101262	Ubuntu 14.04 LTS / 16.04 LTS : Samba vulnerability (USN-3348-1)	Nessus	Ubuntu Local Security Checks	7/6/2017	10/23/2023	medium
102106	RHEL 7 : samba (RHSA-2017:1950)	Nessus	Red Hat Local Security Checks	8/2/2017	10/24/2019	medium
102656	Scientific Linux Security Update : samba on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	8/22/2017	1/14/2021	medium
102156	RHEL 7 : Red Hat Gluster Storage (RHSA-2017:2338)	Nessus	Red Hat Local Security Checks	8/3/2017	10/24/2019	high
102745	CentOS 7 : samba (CESA-2017:1950)	Nessus	CentOS Local Security Checks	8/25/2017	1/4/2021	medium
196754	RHEL 6 : samba (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
102290	Oracle Linux 7 : samba (ELSA-2017-1950)	Nessus	Oracle Linux Local Security Checks	8/9/2017	1/14/2021	medium
103078	EulerOS 2.0 SP2 : samba (EulerOS-SA-2017-1220)	Nessus	Huawei Local Security Checks	9/11/2017	1/6/2021	medium
103453	RHEL 6 : Storage Server (RHSA-2017:2778)	Nessus	Red Hat Local Security Checks	9/25/2017	10/24/2019	high
123959	Debian DLA-1754-1 : samba security update	Nessus	Debian Local Security Checks	4/10/2019	1/11/2021	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

high

medium

medium

high

high