Multiple vulnerabilities has been found and corrected in samba (swat) :

The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element (CVE-2013-0213).

Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions (CVE-2013-0214).

The updated packages have been patched to correct these issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1310 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) or     Common Internet File System (CIFS) protocol, which allows PC-compatible     machines to share files, printers, and other information.

    It was discovered that the Samba Web Administration Tool (SWAT) did not     protect against being opened in a web page frame. A remote attacker could     possibly use this flaw to conduct a clickjacking attack against SWAT users     or users with an active SWAT session. (CVE-2013-0213)

    A flaw was found in the Cross-Site Request Forgery (CSRF) protection     mechanism implemented in SWAT. An attacker with the knowledge of a victim's     password could use this flaw to bypass CSRF protections and conduct a CSRF     attack against the victim SWAT user. (CVE-2013-0214)

    An integer overflow flaw was found in the way Samba handled an Extended     Attribute (EA) list provided by a client. A malicious client could send a     specially crafted EA list that triggered an overflow, causing the server to     loop and reprocess the list using an excessive amount of memory.
    (CVE-2013-4124)

    Note: This issue did not affect the default configuration of the Samba     server.

    Red Hat would like to thank the Samba project for reporting CVE-2013-0213     and CVE-2013-0214. Upstream acknowledges Jann Horn as the original reporter     of CVE-2013-0213 and CVE-2013-0214.

    These updated samba3x packages also include numerous bug fixes. Space     precludes documenting all of these changes in this advisory. Users are     directed to the Red Hat Enterprise Linux 5.10 Technical Notes, linked to in     the References, for information on the most significant of these changes.

    All samba3x users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing this     update, the smb service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This is a LTSS roll-up update for the Samba Server suite fixing multiple security issues and bugs.

Security issues fixed :

  - CVE-2013-4496: Password lockout was not enforced for     SAMR password changes, leading to brute force     possibility.

  - CVE-2013-4408: DCE-RPC fragment length field is     incorrectly checked.

  - CVE-2013-4124: Samba was affected by a denial of service     attack on authenticated or guest connections.

  - CVE-2013-0214: The SWAT webadministration was affected     by a cross site scripting attack (XSS).

  - CVE-2013-0213: The SWAT webadministration could possibly     be used in clickjacking attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2922-1 advisory.

    Jeremy Allison discovered that Samba incorrectly handled ACLs on symlink paths. A remote attacker could     use this issue to overwrite the ownership of ACLs using symlinks. (CVE-2015-7560)

    Garming Sam and Douglas Bagnall discovered that the Samba internal DNS server incorrectly handled certain     DNS TXT records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of     service, or possibly obtain uninitialized memory contents. This issue only applied to Ubuntu 14.04 LTS and     Ubuntu 15.10. (CVE-2016-0771)

    It was discovered that the Samba Web Administration Tool (SWAT) was vulnerable to clickjacking and cross-     site request forgery attacks. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-0213, CVE-2013-0214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed.

Additionally a bug in mount.cifs has been fixed which could have lead to file disclosure. (CVE-2012-1586)

Also a uninitialized memory read bug in talloc_free() has been fixed.
. (bnc#764577)

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 3.6.12 which fixes CVE-2013-0213 and CVE-2013-0214. Update to 3.6.10. Fix printing upgrade code.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-583:01 advisory.

    Description :
    Samba is the suite of programs by which a lot of PC-related machines     share files, printers, and other information (such as lists of     available files and printers). The Windows NT, OS/2, and Linux     operating systems support this natively, and add-on packages can     enable the same thing for DOS, Windows, VMS, UNIX of all kinds, MVS,     and more. This package provides an SMB server that can be used to     provide network services to SMB (sometimes called Lan Manager)     clients. Samba uses NetBIOS over TCP/IP (NetBT) protocols and does NOT     need the NetBEUI (Microsoft Raw NetBIOS frame) protocol.
    Security issues fixed with this release:
    CVE-2013-0213     The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before     4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
    CVE-2013-0214     Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x     before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the     authentication of arbitrary users by leveraging knowledge of a password and composing requests that     perform SWAT actions.
    CVE-2013-4124     Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22,     3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory     consumption) via a malformed packet.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0305 advisory.

    - Security Release, fixes CVE-2013-0213 and CVE-2013-4124

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-033:01 advisory.

    Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other     information (such as lists of available files and printers). The Windows NT, OS/2, and Linux operating     systems support this natively, and add-on packages can enable the same thing for DOS, Windows, VMS, UNIX     of all kinds, MVS, and more. This package provides an SMB/CIFS server that can be used to provide network     services to SMB/CIFS clients. Samba uses NetBIOS over TCP/IP (NetBT) protocols and does NOT need the     NetBEUI (Microsoft Raw NetBIOS frame) protocol.
    Security issues fixed with this release:
     CVE-2013-0213     The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before     4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
     CVE-2013-0214     Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x     before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the     authentication of arbitrary users by leveraging knowledge of a password and composing requests that     perform SWAT actions.
     CVE-2013-4124     Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22,     3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory     consumption) via a malformed packet.
     CVE-2013-4408     Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in     winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain     controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.
     CVE-2013-4475     Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or     vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging     ACL differences between a file and an associated alternate data stream (ADS).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1542 advisory.

    - resolves: #1015359 - Fix CVE-2013-0213 and CVE-2013-0214 in SWAT.
    - resolves: #984808 - CVE-2013-4124: DoS via integer overflow when reading                           an EA list

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated samba3x packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.
(CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba server.

Red Hat would like to thank the Samba project for reporting CVE-2013-0213 and CVE-2013-0214. Upstream acknowledges Jann Horn as the original reporter of CVE-2013-0213 and CVE-2013-0214.

These updated samba3x packages also include numerous bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 5.10 Technical Notes, linked to in the References, for information on the most significant of these changes.

All samba3x users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

Updated samba packages that fix three security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.
(CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba server.

Red Hat would like to thank the Samba project for reporting CVE-2013-0213 and CVE-2013-0214. Upstream acknowledges Jann Horn as the original reporter of CVE-2013-0213 and CVE-2013-0214.

These updated samba packages include numerous bug fixes and one enhancement. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. After installing this update, the smb service will be restarted automatically.

Jann Horn had reported two vulnerabilities in Samba, a popular cross-platform network file and printer sharing suite. In particular, these vulnerabilities affect to SWAT, the Samba Web Administration Tool.

  - CVE-2013-0213: Clickjacking issue in SWAT     An attacker can integrate a SWAT page into a malicious     web page via a frame or iframe and then overlaid by     other content. If an authenticated valid user interacts     with this malicious web page, she might perform     unintended changes in the Samba settings.

  - CVE-2013-0214: Potential Cross-site request forgery     An attacker can persuade a valid SWAT user, who is     logged in as root, to click in a malicious link and     trigger arbitrary unintended changes in the Samba     settings. In order to be vulnerable, the attacker needs     to know the victim's password.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
64626	Mandriva Linux Security Advisory : samba (MDVSA-2013:011)	Nessus	Mandriva Local Security Checks	2013/2/14	2021/1/6	medium
70245	RHEL 5 : samba3x (RHSA-2013:1310)	Nessus	Red Hat Local Security Checks	2013/10/1	2024/11/4	high
83623	SUSE SLES11 Security Update : Samba (SUSE-SU-2014:0723-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
89777	Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2922-1)	Nessus	Ubuntu Local Security Checks	2016/3/9	2025/9/3	medium
64865	SuSE 10 Security Update : Samba (ZYPP Patch Number 8449)	Nessus	SuSE Local Security Checks	2013/2/23	2021/1/19	medium
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
64598	Fedora 16 : samba-3.6.12-1.fc16 (2013-1716)	Nessus	Fedora Local Security Checks	2013/2/13	2021/1/11	medium
289385	MiracleLinux 3 : samba-3.0.33-3.40.0.1.AXS3 (AXSA:2014-583:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
73070	Oracle Linux 5 : samba (ELSA-2014-0305)	Nessus	Oracle Linux Local Security Checks	2014/3/18	2024/10/22	high
290139	MiracleLinux 4 : samba-3.6.9-167.AXS4 (AXSA:2014-033:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
71103	Oracle Linux 6 : samba (ELSA-2013-1542)	Nessus	Oracle Linux Local Security Checks	2013/11/27	2025/4/29	high
79150	CentOS 5 : samba3x (CESA-2013:1310)	Nessus	CentOS Local Security Checks	2014/11/12	2021/1/4	medium
79159	CentOS 6 : samba (CESA-2013:1542)	Nessus	CentOS Local Security Checks	2014/11/12	2021/1/4	medium
64397	Debian DSA-2617-1 : samba - several issues	Nessus	Debian Local Security Checks	2013/2/4	2021/1/11	medium

检测

插件搜索

medium

high

high

medium

medium

critical

medium

high

high

high

high

medium

medium

medium