The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5142-1 advisory.

    Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote attacker     could possibly use this issue to downgrade connections to plaintext authentication. (CVE-2016-2124)

    Andrew Bartlett discovered that Samba incorrectly mapping domain users to local users. An authenticated     attacker could possibly use this issue to become root on domain members. (CVE-2020-25717)

    Andrew Bartlett discovered that Samba did not correctly sandbox Kerberos tickets issues by an RODC. An     RODC could print administrator tickets, contrary to expectations. (CVE-2020-25718)

    Andrew Bartlett discovered that Samba incorrectly handled Kerberos tickets. Delegated administrators could     possibly use this issue to impersonate accounts, leading to total domain compromise. (CVE-2020-25719)

    Andrew Bartlett discovered that Samba did not provide stable AD identifiers to Kerberos acceptors.
    (CVE-2020-25721)

    Andrew Bartlett discovered that Samba did not properly check sensitive attributes. An authenticated     attacker could possibly use this issue to escalate privileges. (CVE-2020-25722)

    Stefan Metzmacher discovered that Samba incorrectly handled certain large DCE/RPC requests. A remote     attacker could possibly use this issue to bypass signature requirements. (CVE-2021-23192)

    William Ross discovered that Samba incorrectly handled memory. A remote attacker could use this issue to     cause Samba to crash, resulting in a denial of service, or possibly escalate privileges. (CVE-2021-3738)

    Joseph Sutton discovered that Samba incorrectly handled certain TGS requests. An authenticated attacker     could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2021-3671)

    The fix for CVE-2020-25717 results in possible behaviour changes that could affect certain environments.
    Please see the upstream advisory for more information:

    https://www.samba.org/samba/security/CVE-2020-25717.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5174-1 advisory.

    Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client connections. A remote attacker     could possibly use this issue to downgrade connections to plaintext authentication. (CVE-2016-2124)

    Andrew Bartlett discovered that Samba incorrectly mapping domain users to local users. An authenticated     attacker could possibly use this issue to become root on domain members. (CVE-2020-25717)

    Andrew Bartlett discovered that Samba did not properly check sensitive attributes. An authenticated     attacker could possibly use this issue to escalate privileges. (CVE-2020-25722)

    Joseph Sutton discovered that Samba incorrectly handled certain TGS requests. An authenticated attacker     could possibly use this issue to cause Samba to crash, resulting in a denial of service. (CVE-2021-3671)

    The fix for CVE-2020-25717 results in possible behaviour changes that could affect certain environments.
    Please see the upstream advisory for more information:

    https://www.samba.org/samba/security/CVE-2020-25717.html

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0020-1 advisory.

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue,     where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be     opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by     forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD     DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the     not-delegated flag set. (CVE-2019-14870)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

  - Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a     preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept. (CVE-2021-44758)

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

  - Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a     denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via     PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users     should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue. (CVE-2022-41916)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

  - Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the     ASN.1 codec used by the Key Distribution Center (KDC). (CVE-2022-44640)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-2c77cee4b5 advisory.

    Fixes:

    * Delay service starts until after network is online (rhbz#2005501)
    * Restart services on package update (will apply when updating from this release)


    ----

    This release fixes the following Security Vulnerabilities:

    * CVE-2022-42898 PAC parse integer overflows
    * CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour
    * CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array
    * CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors
    * CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ
    * CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec

    Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring     System (CVSS) v3.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-3671 advisory.

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
155297	Ubuntu 20.04 LTS : Samba vulnerabilities (USN-5142-1)	Nessus	Ubuntu Local Security Checks	2021/11/12	2024/8/28	high
155936	Ubuntu 18.04 LTS : Samba vulnerabilities (USN-5174-1)	Nessus	Ubuntu Local Security Checks	2021/12/8	2024/8/27	high
170098	openSUSE 15 Security Update : libheimdal (openSUSE-SU-2023:0020-1)	Nessus	SuSE Local Security Checks	2023/1/17	2023/9/7	critical
256578	Linux Distros Unpatched Vulnerability : CVE-2021-3671	Nessus	Misc.	2025/8/27	2026/7/24	medium
211098	Fedora 37 : heimdal (2022-2c77cee4b5)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	critical
295682	Azure Linux 3.0 Security Update: samba (CVE-2021-3671)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium

检测

插件搜索

high

high

critical

medium

critical

medium