The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4611-1 advisory.

    Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could     possibly use this issue to obtain file name information. (CVE-2020-14318)

    Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could     possibly use this issue to cause winbind to crash, resulting in a denial of service. (CVE-2020-14323)

    Francis Brosnan Blzquez discovered that Samba incorrectly handled certain invalid DNS records. A remote     attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service.
    (CVE-2020-14383)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to Samba 4.13.1 - Security fixes for CVE-2020-14318, CVE-2020-14323 and CVE-2020-14383

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Samba running on the remote host is 3.6.x prior to 4.11.15, 4.12.x prior to 4.12.9, or 4.13.x prior to 4.13.1.  It is, therefore, potentially affected by multiple vulnerabilities, including the following:

  - A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this flaw to crash the Winbind service causing denial of     service. (CVE-2020-14323)

  - A missing permissions check on a directory handle can leak file name information to unprivileged accounts.
    (CVE-2020-14318)

  - An error in Samba's dnsserver RPC pipe when no data is present in the DNS records additional section. An     authenticated, non-admin user can exploit this to crash the DNS server by adding invalid records.
    (CVE-2020-14383)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for samba fixes the following issues :

Update to samba 4.11.14

CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).

CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).

CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

lib/util: Do not install /usr/bin/test_util

smbd: don't log success as error

idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;

winbind: Fix a memleak

idmap_ad: Pass tldap debug messages on to DEBUG()

lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE

ctdb disable/enable can fail due to race condition

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3792 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3792-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Santiago Ruano Rincn     April 22, 2024                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : samba     Version        : 2:4.9.5+dfsg-5+deb10u5     CVE ID         : CVE-2020-14318 CVE-2020-14323 CVE-2020-14383 CVE-2022-2127                      CVE-2022-3437 CVE-2022-32742 CVE-2023-4091

    Several vulnerabilities were discovered in Samba, SMB/CIFS file,     print, and login server for Unix

    CVE-2020-14318

        Missing handle permissions check in ChangeNotify

    CVE-2020-14323

        Unprivileged user can crash winbind via invalid lookupsids DoS

    CVE-2020-14383

        DNS server crash via invalid records resulting from uninitialized         variables

    CVE-2022-2127

        Out-of-bounds read in winbind AUTH_CRAP

    CVE-2022-3437

        Heimdal des/des3 heap-based buffer overflow

    CVE-2022-32742

        Server memory information leak via SMB1

    CVE-2023-4091

        Client can truncate files even with read-only permissions

    For Debian 10 buster, these problems have been fixed in version     2:4.9.5+dfsg-5+deb10u5.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
142218	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Samba vulnerabilities (USN-4611-1)	Nessus	Ubuntu Local Security Checks	2020/11/2	2024/8/27	medium
142351	Fedora 33 : 2:samba (2020-c1e9ae02d2)	Nessus	Fedora Local Security Checks	2020/11/3	2020/12/8	medium
142419	Samba 3.6.x < 4.11.15 / 4.12.x < 4.12.9 / 4.13.x < 4.13.1 Multiple Vulnerabilities	Nessus	Misc.	2020/11/4	2021/6/3	medium
143848	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2020:3081-1)	Nessus	SuSE Local Security Checks	2020/12/9	2021/1/13	medium
144674	EulerOS 2.0 SP9 : samba (EulerOS-SA-2021-1017)	Nessus	Huawei Local Security Checks	2021/1/4	2024/1/31	medium
148068	EulerOS 2.0 SP5 : samba (EulerOS-SA-2021-1704)	Nessus	Huawei Local Security Checks	2021/3/24	2024/1/8	medium
193744	Debian dla-3792 : ctdb - security update	Nessus	Debian Local Security Checks	2024/4/23	2026/1/21	medium
147061	EulerOS Virtualization 3.0.6.6 : samba (EulerOS-SA-2021-1517)	Nessus	Huawei Local Security Checks	2021/3/4	2026/1/12	medium
145189	EulerOS 2.0 SP3 : samba (EulerOS-SA-2021-1118)	Nessus	Huawei Local Security Checks	2021/1/20	2026/1/12	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium