The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:2074 advisory.

  - samba: Symlink race error can allow metadata read and modify outside of the exported share     (CVE-2021-20316)

  - samba: Information leak via symlinks of existance of files or directories outside of the exported share     (CVE-2021-44141)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:2074 advisory.

  - All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
    (CVE-2021-44141)

  - A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-20316 advisory.

  - A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0176 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2016-2124:
    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

    CVE-2020-25717:
    A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation.

    CVE-2021-20316:
    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share.

    CVE-2021-44141:
    All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

    CVE-2021-23192:
    A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data,     bypassing the signature requirements.

    CVE-2022-32742:
    A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-022 advisory.

    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

    A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

    A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC     (read-only domain controller). This would allow an RODC to print administrator tickets. (CVE-2020-25718)

    A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication.   The Samba AD DC, could become confused about the user a ticket represents if it     did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include     total domain compromise. (CVE-2020-25719)

    Kerberos acceptors need easy access to stableAD identifiers (eg objectSid) (CVE-2020-25721)

    Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored     data. An attacker could use this flaw to cause total domain compromise. (CVE-2020-25722)

    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

    A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with     their own data, bypassing the signature requirements. (CVE-2021-23192)

    Use after free in Samba AD DC RPC server (CVE-2021-3738)

    Information leak via symlinks of existance of files or directories outside of the exported share     (CVE-2021-44141)

    Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution (CVE-2021-44142)

    Samba AD users with permission to write to an account can impersonate arbitrary services (CVE-2022-0336)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3454:06 advisory.

    * samba: Symlink race error can allow metadata read and modify outside of the exported share     (CVE-2021-20316)
      * samba: Information leak via symlinks of existance of files or directories outside of the exported     share (CVE-2021-44141)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0283-1 advisory.

  - A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be     ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory,     resulting in a crash. The highest threat from this vulnerability is to system availability.
    (CVE-2020-27840)

  - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to     an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The     highest threat from this vulnerability is to system availability. (CVE-2021-20277)

  - ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before     1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon     crash. This occurs because a return value is not properly managed in a certain situation. (CVE-2021-36222)

  - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to     allow a directory to be created in an area of the server file system not exported under the share     definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack     to succeed. (CVE-2021-43566)

  - All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed. Clients that     have write access to the exported part of the file system under a share via SMB1 unix extensions or via     NFS can create symlinks that point to arbitrary files or directories on the server filesystem. Clients can     then use SMB1 unix extension information queries to determine if the target of the symlink exists or not     by examining error codes returned from the smbd server. There is no ability to access these files or     directories, only to determine if they exist or not. If SMB1 is turned off and only SMB2 is used, or unix     extensions are not enabled then there is no way to discover if a symlink points to a valid target or not     via SMB2. For this reason, even if symlinks are created via NFS, if the Samba server does not allow SMB1     with unix extensions there is no way to exploit this bug. Finding out what files or directories exist on a     file server can help attackers guess system user names or the exact operating system release and     applications running on the server hosting Samba which may help mount further attacks. SMB1 has been     disabled on Samba since version 4.11.0 and onwards. Exploitation of this bug has not been seen in the     wild. (CVE-2021-44141)

  - samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution     (CVE-2021-44142)

  - The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that     SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an     account modification re-adds an SPN that was previously present on that account, such as one added when a     computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to     perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an     attacker who can intercept traffic can impersonate existing services, resulting in a loss of     confidentiality and integrity. (CVE-2022-0336)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
160964	CentOS 8 : samba (CESA-2022:2074)	Nessus	CentOS Local Security Checks	2022/5/10	2022/11/1	medium
161339	Rocky Linux 8 : samba (RLSA-2022:2074)	Nessus	Rocky Linux Local Security Checks	2022/5/18	2023/11/6	medium
295346	Azure Linux 3.0 Security Update: samba (CVE-2021-20316)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/2/24	medium
236698	Alibaba Cloud Linux 3 : 0176: samba (ALINUX3-SA-2022:0176)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
223629	Linux Distros Unpatched Vulnerability : CVE-2021-20316	Nessus	Misc.	2025/3/4	2026/7/24	medium
212474	Amazon Linux 2022 : ctdb, ctdb-pcp-pmda, libsmbclient (ALAS2022-2022-022)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2024/12/16	high
294529	MiracleLinux 8 : samba-4.15.5-5.el8 (AXSA:2022-3454:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
157325	openSUSE 15 Security Update : samba (openSUSE-SU-2022:0283-1)	Nessus	SuSE Local Security Checks	2022/2/2	2023/11/1	high

检测

插件搜索

medium

medium

medium

high

medium

high

medium

high