The remote host is affected by the vulnerability described in GLSA-202310-06 (Heimdal: Multiple Vulnerabilities)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue,     where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be     opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by     forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD     DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the     not-delegated flag set. (CVE-2019-14870)

  - Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a     preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept. (CVE-2021-44758)

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

  - A vulnerability classified as critical was found in SourceCodester eLearning System 1.0. This     vulnerability affects unknown code of the file /admin/students/manage.php. The manipulation of the     argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed     to the public and may be used. VDB-212014 is the identifier assigned to this vulnerability.
    (CVE-2022-3671)

  - Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a     denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via     PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users     should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue. (CVE-2022-41916)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

  - Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the     ASN.1 codec used by the Key Distribution Center (KDC). (CVE-2022-44640)

  - The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug     by adding != 0 comparisons to the result of memcmp. When these patches were backported to the     heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in     causing the validation of message integrity codes in gssapi/arcfour to be inverted. (CVE-2022-45142)

  -  Please review the referenced CVE identifiers for details.  (CVE-2022-44758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Samba running on the remote host is 4.x prior to 4.9.17, 4.10.x prior to 4.10.11, or 4.11.x prior to 4.11.3.  It is, therefore, affected by multiple vulnerabilities:

  - A denial of service (DoS) vulnerability exists in the ldb_qsort() and dns_name_compare() routines due to     how the routines handle case sensitivity of DNS records. An authenticated, remote attacker can exploit     this issue, by registering a DNS record matching the name of the DNS zone, to cause the process to stop     responding. (CVE-2019-14861)

  - An issue exists where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset     of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos     authentication, by forcing all tickets for these clients to be non-forwardable. In AD this is implemented     by a user attribute delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable.
    However the Samba AD DC does not do that for S4U2Self and does set the forwardable flag even if the     impersonated client has the not-delegated flag set. (CVE-2019-14870)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for samba fixes the following issues :

CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name (bsc#1158108).

CVE-2019-14870: Fixed a DelegationNotAllowed not being enforced (bsc#1158109).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

  - CVE-2019-14861: Fixed a DNSServer RPC server crash, that     allowed an authenticated user to crash the DCE/RPC DNS     management server by creating records with matching the     zone name (bsc#1158108).

  - CVE-2019-14870: Fixed a DelegationNotAllowed not being     enforced (bsc#1158109).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
182758	GLSA-202310-06 : Heimdal: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2023/10/8	2023/12/22	critical
132023	Samba 4.x < 4.9.17 / 4.10.x < 4.10.11 / 4.11.x < 4.11.3 Multiple Vulnerabilities	Nessus	Misc.	2019/12/13	2020/1/23	medium
132239	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2019:3319-1)	Nessus	SuSE Local Security Checks	2019/12/18	2021/1/13	medium
132386	openSUSE Security Update : samba (openSUSE-2019-2700)	Nessus	SuSE Local Security Checks	2019/12/23	2024/4/2	medium

检测

插件搜索

critical

medium

medium

medium