The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:2074 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    The following packages have been upgraded to a later upstream version: samba (4.15.5). (BZ#2013596)

    Security Fix(es):

    * samba: Symlink race error can allow metadata read and modify outside of the exported share     (CVE-2021-20316)

    * samba: Information leak via symlinks of existance of files or directories outside of the exported share     (CVE-2021-44141)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-2074 advisory.

    - resolves: rhbz#2046127 - Fix CVE-2021-44141
    - resolves: rhbz#2046153 - Fix CVE-2021-44142
    - resolves: rhbz#2039153 - Fix CVE-2021-20316
    - resolves: rhbz#2039157 - Fix CVE-2021-43566
    - related: rbhz#2019674 - Fix CVE-2020-25717
    - related: rbhz#2019674 - Fix CVE-2020-25717

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-032 advisory.

    2024-02-15: CVE-2016-2124 was added to this advisory.

    2024-02-15: CVE-2021-44141 was added to this advisory.

    2024-02-15: CVE-2021-20316 was added to this advisory.

    2024-02-15: CVE-2020-17049 was added to this advisory.

    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

    It was found that the Kerberos Key Distribution Center (KDC) delegation feature, Service for User (S4U),     did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service     principal allowed to delegate could use this flaw to impersonate a non-forwardable user. (CVE-2020-17049)

    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share.

    A fix for CVE-2021-20316 will not be provided for Amazon Linux 1 and Amazon Linux 2. You can mitigate this     issue by disabling SMBv1.To do so, add server min protocol = SMB2 to the [global] section of     /etc/samba/smb.conf (CVE-2021-20316)

    All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to     allow a directory to be created in an area of the server file system not exported under the share     definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack     to succeed. (CVE-2021-43566)

    All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

    A fix for CVE-2021-44141 for will not be provided for Amazon Linux 1 and Amazon Linux 2. You can mitigate     this issue by disabling SMBv1.To do so, add server min protocol = SMB2 to the [global] section of     /etc/samba/smb.conf (CVE-2021-44141)

    Samba AD users with permission to write to an account can impersonate arbitrary services (CVE-2022-0336)

    In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. (CVE-2022-1615)

    A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer). (CVE-2022-32742)

    Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit     unprivileged users to write it. (CVE-2022-32743)

    A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl. (CVE-2022-32746)

    A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

    Samba 4.17 introduced following symlinks in user space with the intent to properly check symlink targets     to stay within the share that was configured by the administrator. The check does not properly cover a     corner case, so that a user can create a symbolic link that will make smbd escape the configured share     path. (CVE-2022-3592)

    Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability. (CVE-2022-37966)

    Windows Kerberos Elevation of Privilege Vulnerability. (CVE-2022-37967)

    Netlogon RPC Elevation of Privilege Vulnerability. (CVE-2022-38023)

    Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets (CVE-2022-45141)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3454:06 advisory.

    * samba: Symlink race error can allow metadata read and modify outside of the exported share     (CVE-2021-20316)
      * samba: Information leak via symlinks of existance of files or directories outside of the exported     share (CVE-2021-44141)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0283-1 advisory.

  - A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be     ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory,     resulting in a crash. The highest threat from this vulnerability is to system availability.
    (CVE-2020-27840)

  - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to     an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The     highest threat from this vulnerability is to system availability. (CVE-2021-20277)

  - ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before     1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon     crash. This occurs because a return value is not properly managed in a certain situation. (CVE-2021-36222)

  - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to     allow a directory to be created in an area of the server file system not exported under the share     definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack     to succeed. (CVE-2021-43566)

  - All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed. Clients that     have write access to the exported part of the file system under a share via SMB1 unix extensions or via     NFS can create symlinks that point to arbitrary files or directories on the server filesystem. Clients can     then use SMB1 unix extension information queries to determine if the target of the symlink exists or not     by examining error codes returned from the smbd server. There is no ability to access these files or     directories, only to determine if they exist or not. If SMB1 is turned off and only SMB2 is used, or unix     extensions are not enabled then there is no way to discover if a symlink points to a valid target or not     via SMB2. For this reason, even if symlinks are created via NFS, if the Samba server does not allow SMB1     with unix extensions there is no way to exploit this bug. Finding out what files or directories exist on a     file server can help attackers guess system user names or the exact operating system release and     applications running on the server hosting Samba which may help mount further attacks. SMB1 has been     disabled on Samba since version 4.11.0 and onwards. Exploitation of this bug has not been seen in the     wild. (CVE-2021-44141)

  - samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution     (CVE-2021-44142)

  - The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that     SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an     account modification re-adds an SPN that was previously present on that account, such as one added when a     computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to     perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an     attacker who can intercept traffic can impersonate existing services, resulting in a loss of     confidentiality and integrity. (CVE-2022-0336)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0176 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2016-2124:
    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

    CVE-2020-25717:
    A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation.

    CVE-2021-20316:
    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share.

    CVE-2021-44141:
    All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

    CVE-2021-23192:
    A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data,     bypassing the signature requirements.

    CVE-2022-32742:
    A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-022 advisory.

    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

    A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

    A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC     (read-only domain controller). This would allow an RODC to print administrator tickets. (CVE-2020-25718)

    A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication.   The Samba AD DC, could become confused about the user a ticket represents if it     did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include     total domain compromise. (CVE-2020-25719)

    Kerberos acceptors need easy access to stableAD identifiers (eg objectSid) (CVE-2020-25721)

    Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored     data. An attacker could use this flaw to cause total domain compromise. (CVE-2020-25722)

    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

    A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with     their own data, bypassing the signature requirements. (CVE-2021-23192)

    Use after free in Samba AD DC RPC server (CVE-2021-3738)

    Information leak via symlinks of existance of files or directories outside of the exported share     (CVE-2021-44141)

    Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution (CVE-2021-44142)

    Samba AD users with permission to write to an account can impersonate arbitrary services (CVE-2022-0336)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161020	RHEL 8 : samba (RHSA-2022:2074)	Nessus	Red Hat Local Security Checks	2022/5/11	2024/11/7	medium
161285	Oracle Linux 8 : samba (ELSA-2022-2074)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/11/1	medium
173148	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-032)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2026/1/9	critical
294529	MiracleLinux 8 : samba-4.15.5-5.el8 (AXSA:2022-3454:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
157325	openSUSE 15 Security Update : samba (openSUSE-SU-2022:0283-1)	Nessus	SuSE Local Security Checks	2022/2/2	2023/11/1	high
223629	Linux Distros Unpatched Vulnerability : CVE-2021-20316	Nessus	Misc.	2025/3/4	2025/8/30	medium
236698	Alibaba Cloud Linux 3 : 0176: samba (ALINUX3-SA-2022:0176)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
212474	Amazon Linux 2022 : ctdb, ctdb-pcp-pmda, libsmbclient (ALAS2022-2022-022)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2024/12/16	high

检测

插件搜索

medium

medium

critical

medium

high

medium

high

high