The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - COS kernel
  - cURL
  - python
  - rpm

According to its banner, the version of Samba 3.x running on the remote host is earlier than 3.3.16 / 3.4.14 / 3.5.10. As such, it is potentially affected by several vulnerabilities in the Samba Web Administration Tool (SWAT) :

  - A cross-site scripting vulnerability exists because of a     failure to sanitize input to the username parameter of     the 'passwd' program. (Issue #8289)

  - A cross-site request forgery (CSRF) vulnerability can     allow SWAT to be manipulated when a user who is logged     in as root is tricked into clicking specially crafted     URLs sent by an attacker. (Issue #8290)

Note that these issues are only exploitable when SWAT it enabled, and it is not enabled by default.

Also note that Nessus has relied only on the self-reported version number and has not actually determined whether SWAT is enabled, tried to exploit these issues, or determine if the associated patches have been applied.

Samba security advisory reports :

All current released versions of Samba are vulnerable to a cross-site request forgery in the Samba Web Administration Tool (SWAT). By tricking a user who is authenticated with SWAT into clicking a manipulated URL on a different web page, it is possible to manipulate SWAT.

All current released versions of Samba are vulnerable to a cross-site scripting issue in the Samba Web Administration Tool (SWAT). On the 'Change Password' field, it is possible to insert arbitrary content into the 'user' field.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1219 advisory.

  - samba: mount.cifs improper device name and mountpoint strings sanitization (CVE-2010-0547)

  - samba: Race condition by mount (mount.cifs) operations (CVE-2010-0787)

  - samba/cifs-utils: mount.cifs and umount.cifs fail to anticipate RLIMIT_FSIZE (CVE-2011-1678)

  - samba (SWAT): Absent CSRF protection in various Samba web configuration formulars (CVE-2011-2522)

  - samba (SWAT): XSS flaw in Change Password page (CVE-2011-2694)

  - Samba mtab lock file race condition (CVE-2011-3585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

a. ESX third-party update for Service Console kernel      The ESX Service Console Operating System (COS) kernel is updated to    kernel-2.6.18-274.3.1.el5 to fix multiple security issues in the    COS kernel.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-0726, CVE-2011-1078, CVE-2011-1079,    CVE-2011-1080, CVE-2011-1093, CVE-2011-1163, CVE-2011-1166,    CVE-2011-1170, CVE-2011-1171, CVE-2011-1172, CVE-2011-1494,    CVE-2011-1495, CVE-2011-1577, CVE-2011-1763, CVE-2010-4649,    CVE-2011-0695, CVE-2011-0711, CVE-2011-1044, CVE-2011-1182,    CVE-2011-1573, CVE-2011-1576, CVE-2011-1593, CVE-2011-1745,    CVE-2011-1746, CVE-2011-1776, CVE-2011-1936, CVE-2011-2022,    CVE-2011-2213, CVE-2011-2492, CVE-2011-1780, CVE-2011-2525,    CVE-2011-2689, CVE-2011-2482, CVE-2011-2491, CVE-2011-2495,    CVE-2011-2517, CVE-2011-2519, CVE-2011-2901 to these issues.
  b. ESX third-party update for Service Console cURL RPM      The ESX Service Console (COS) curl RPM is updated to cURL-7.15.5.9    resolving a security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the name CVE-2011-2192 to this issue.
  c. ESX third-party update for Service Console nspr and nss RPMs      The ESX Service Console (COS) nspr and nss RPMs are updated to    nspr-4.8.8-1.el5_7 and nss-3.12.10-4.el5_7 respectively resolving    a security issues.
     A Certificate Authority (CA) issued fraudulent SSL certificates and    Netscape Portable Runtime (NSPR) and Network Security Services (NSS)    contain the built-in tokens of this fraudulent Certificate    Authority. This update renders all SSL certificates signed by the    fraudulent CA as untrusted for all uses.
  d. ESX third-party update for Service Console rpm RPMs      The ESX Service Console Operating System (COS) rpm packages are    updated to popt-1.10.2.3-22.el5_7.2, rpm-4.4.2.3-22.el5_7.2,    rpm-libs-4.4.2.3-22.el5_7.2 and rpm-python-4.4.2.3-22.el5_7.2    which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-2059 and CVE-2011-3378 to these    issues.
  e. ESX third-party update for Service Console samba RPMs      The ESX Service Console Operating System (COS) samba packages are    updated to samba-client-3.0.33-3.29.el5_7.4,    samba-common-3.0.33-3.29.el5_7.4 and    libsmbclient-3.0.33-3.29.el5_7.4 which fixes multiple security    issues in the Samba client.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0547, CVE-2010-0787, CVE-2011-1678,    CVE-2011-2522 and CVE-2011-2694 to these issues.
     Note that ESX does not include the Samba Web Administration Tool    (SWAT) and therefore ESX COS is not affected by CVE-2011-2522 and    CVE-2011-2694.
  f. ESX third-party update for Service Console python package      The ESX Service Console (COS) python package is updated to    2.4.3-44 which fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3720, CVE-2010-3493, CVE-2011-1015 and    CVE-2011-1521 to these issues.
  g. ESXi update to third-party component python      The python third-party library is updated to python 2.5.6 which    fixes multiple security issues.
     The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2009-3560, CVE-2009-3720, CVE-2010-1634,    CVE-2010-2089, and CVE-2011-1521 to these issues.

New samba packages are available for Slackware 13.1, 13.37, and
-current to fix security issues.

The Samba Web Administration Tool (SWAT) contains several cross-site request forgery (CSRF) vulnerabilities (CVE-2011-2522 ) and a cross-site scripting vulnerability (CVE-2011-2694 ).

A cross-site request forgery (CSRF) and a cross-site scripting vulnerability have been fixed in samba's SWAT.

  - (AV:N/AC:M/Au:S/C:N/I:P/A:N) CVE-2011-2694: CVSS v2 Base     Score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N). (CVE-2011-2522:
    CVSS v2 Base Score: 3.5)

A Cross-Site Request Forgery (CSRF) and a Cross Site Scripting vulnerability have been fixed in samba's SWAT. CVE-2011-2522 and CVE-2011-2694 have been assigned.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
89105	VMware ESX / ESXi Service Console and Third-Party Libraries Multiple Vulnerabilities (VMSA-2012-0001) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	high
55733	Samba 3.x < 3.3.16 / 3.4.14 / 3.5.10 Multiple Vulnerabilities	Nessus	Misc.	2011/7/29	2018/11/15	medium
55877	FreeBSD : Samba -- XSS and request forgery vulnerabilities (56f4b3a6-c82c-11e0-a498-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	2011/8/17	2021/1/6	medium
55999	RHEL 4 / 5 : samba (RHSA-2011:1219)	Nessus	Red Hat Local Security Checks	2011/8/30	2024/4/27	medium
57749	VMSA-2012-0001 : VMware ESXi and ESX updates to third-party library and ESX Service Console	Nessus	VMware ESX Local Security Checks	2012/1/31	2021/1/6	high
55737	Slackware 13.1 / 13.37 / current : samba (SSA:2011-210-03)	Nessus	Slackware Local Security Checks	2011/8/1	2021/1/14	medium
55770	Debian DSA-2290-1 : samba - XSS	Nessus	Debian Local Security Checks	2011/8/8	2021/1/11	medium
56601	SuSE 10 Security Update : Samba (ZYPP Patch Number 7656)	Nessus	SuSE Local Security Checks	2011/10/24	2021/1/19	medium
75569	openSUSE Security Update : ldapsmb (openSUSE-SU-2011:0998-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium

检测

插件搜索

high

medium

medium

medium

high

medium

medium

medium

medium