samba's make_connection_snum() handles certain input incorrectly, which may lead to disclosure of the root directory. CVE-2009-2813 has been assigned to this issue. Additionally an information disclosure vulnerability in mount.cifs has been fixed (CVE-2009-2948) as well as a DoS condition. (CVE-2009-2906)

samba's make_connection_snum() handles certain input incorrectly, which may lead to disclosure of the root directory. CVE-2009-2813 has been assigned to this issue. Additionally an information disclosure vulnerability in mount.cifs has been fixed (CVE-2009-2948) as well as a DoS condition (CVE-2009-2906).

a. Service Console update for samba to 3.0.33-3.15.el5_4.1

   This update changes the samba packages to    samba-client-3.0.33-3.15.el5_4.1 and    samba-common-3.0.33-3.15.el5_4.1. These versions include fixes for    security issues that were first fixed in    samba-client-3.0.33-0.18.el4_8 and samba-common-3.0.33-0.18.el4_8.
       The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the names CVE-2009-2906, CVE-2009-1888,CVE-2009-2813    and CVE-2009-2948 to these issues.

b. Service Console update for acpid to1.0.4-9.el5_4.2

   This updates changes the the acpid package to acpid-1.0.4-9.el5_4.2.
   This version includes the fix for a security issue that was first    fixed in acpid-1.0.4-7.el5_4.1.  

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0798 to this issue.

A denial of service flaw was found in the Samba smbd daemon. An authenticated, remote user could send a specially crafted response that would cause an smbd child process to enter an infinite loop. An authenticated, remote user could use this flaw to exhaust system resources by opening multiple CIFS sessions. (CVE-2009-2906)

An uninitialized data access flaw was discovered in the smbd daemon when using the non-default 'dos filemode' configuration option in 'smb.conf'. An authenticated, remote user with write access to a file could possibly use this flaw to change an access control list for that file, even when such access should have been denied. (CVE-2009-1888)

A flaw was discovered in the way Samba handled users without a home directory set in the back-end password database (e.g. '/etc/passwd').
If a share for the home directory of such a user was created (e.g.
using the automated '[homes]' share), any user able to access that share could see the whole file system, possibly bypassing intended access restrictions.(CVE-2009-2813)

The mount.cifs program printed CIFS passwords as part of its debug output when running in verbose mode. When mount.cifs had the setuid bit set, a local, unprivileged user could use this flaw to disclose passwords from a file that would otherwise be inaccessible to that user. Note: mount.cifs from the samba packages distributed by Red Hat does not have the setuid bit set. This flaw only affected systems where the setuid bit was manually set by an administrator.
(CVE-2009-2948) This update also fixes the following bug for SL3 :

  - an earlier update added code to escape input passed to     scripts that are run by Samba. This code was missing 'c'     from the list of valid characters, causing it to be     escaped. With this update, the previous patch has been     updated to include 'c' in the list of valid characters.
    (BZ#242754)

After installing this update, the smb service will be restarted automatically.

Several vulnerabilities have been discovered in samba, an implementation of the SMB/CIFS protocol for Unix systems, providing support for cross-platform file and printer sharing with other operating systems and more. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-2948     The mount.cifs utility is missing proper checks for file     permissions when used in verbose mode. This allows local     users to partly disclose the content of arbitrary files     by specifying the file as credentials file and     attempting to mount a samba share.

  - CVE-2009-2906     A reply to an oplock break notification which samba     doesn't expect could lead to the service getting stuck     in an infinite loop. An attacker can use this to perform     denial of service attacks via a specially crafted SMB     request.

  - CVE-2009-2813     A lack of error handling in case no home directory was     configured/specified for the user could lead to file     disclosure. In case the automated [homes] share is     enabled or an explicit share is created with that     username, samba fails to enforce sharing restrictions     which results in an attacker being able to access the     file system from the root directory.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
42233	SuSE 11 Security Update : Samba (SAT Patch Number 1352)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	medium
42321	openSUSE 10 Security Update : cifs-mount (cifs-mount-6519)	Nessus	SuSE Local Security Checks	2009/10/30	2021/1/14	medium
42228	openSUSE Security Update : cifs-mount (cifs-mount-1354)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	medium
45402	VMSA-2010-0006 : ESX Service Console updates for samba and acpid	Nessus	VMware ESX Local Security Checks	2010/4/2	2021/1/6	medium
60684	Scientific Linux Security Update : samba on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
44773	Debian DSA-1908-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	medium
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical

检测

插件搜索

medium

medium

medium

medium

medium

medium

critical