This is a LTSS roll-up update for the Samba Server suite fixing multiple security issues and bugs.

Security issues fixed :

  - CVE-2013-4496: Password lockout was not enforced for     SAMR password changes, leading to brute force     possibility.

  - CVE-2013-4408: DCE-RPC fragment length field is     incorrectly checked.

  - CVE-2013-4124: Samba was affected by a denial of service     attack on authenticated or guest connections.

  - CVE-2013-0214: The SWAT webadministration was affected     by a cross site scripting attack (XSS).

  - CVE-2013-0213: The SWAT webadministration could possibly     be used in clickjacking attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2922-1 advisory.

    Jeremy Allison discovered that Samba incorrectly handled ACLs on symlink paths. A remote attacker could     use this issue to overwrite the ownership of ACLs using symlinks. (CVE-2015-7560)

    Garming Sam and Douglas Bagnall discovered that the Samba internal DNS server incorrectly handled certain     DNS TXT records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of     service, or possibly obtain uninitialized memory contents. This issue only applied to Ubuntu 14.04 LTS and     Ubuntu 15.10. (CVE-2016-0771)

    It was discovered that the Samba Web Administration Tool (SWAT) was vulnerable to clickjacking and cross-     site request forgery attacks. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-0213, CVE-2013-0214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed.

Additionally a bug in mount.cifs has been fixed which could have lead to file disclosure (CVE-2012-1586).

Also a uninitialized memory read bug in talloc_free() has been fixed.
(bnc#764577).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Samba running on the remote host is 3.5.x prior to 3.5.21, 3.6.x prior to 3.6.12, or 4.x prior to 4.0.1. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw exists in the Samba Web     Administration Tool (SWAT) that allows a remote attacker     to conduct clickjacking attacks via a FRAME or IFRAME     element. (CVE-2013-0213)

  - A cross-site request forgery vulnerability exists due to     a failure to require multiple steps or explicit     confirmation for sensitive transactions in the Samba     Web Administration Tool (SWAT). A remote attacker can     exploit this, by convincing a user to follow a crafted     URL, to cause the user to perform unintended actions.
    (CVE-2013-0213)

Note that these vulnerabilities are only exploitable when SWAT is enabled, and it is not enabled by default. Additionally, note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1310 advisory.

    - resolves: #984807 - CVE-2013-4124: DoS via integer overflow when reading                           an EA list
    - Fix CVE-2013-0213 and CVE-2013-0214.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.
(CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba server.

After installing this update, the smb service will be restarted automatically.

Updated samba packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.
(CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba server.

Red Hat would like to thank the Samba project for reporting CVE-2013-0213 and CVE-2013-0214. Upstream acknowledges Jann Horn as the original reporter of CVE-2013-0213 and CVE-2013-0214.

All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-033:01 advisory.

    Samba is the suite of programs by which a lot of PC-related machines share files, printers, and other     information (such as lists of available files and printers). The Windows NT, OS/2, and Linux operating     systems support this natively, and add-on packages can enable the same thing for DOS, Windows, VMS, UNIX     of all kinds, MVS, and more. This package provides an SMB/CIFS server that can be used to provide network     services to SMB/CIFS clients. Samba uses NetBIOS over TCP/IP (NetBT) protocols and does NOT need the     NetBEUI (Microsoft Raw NetBIOS frame) protocol.
    Security issues fixed with this release:
     CVE-2013-0213     The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before     4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
     CVE-2013-0214     Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x     before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the     authentication of arbitrary users by leveraging knowledge of a password and composing requests that     perform SWAT actions.
     CVE-2013-4124     Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22,     3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory     consumption) via a malformed packet.
     CVE-2013-4408     Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in     winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain     controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.
     CVE-2013-4475     Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or     vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging     ACL differences between a file and an associated alternate data stream (ADS).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jann Horn had reported two vulnerabilities in Samba, a popular cross-platform network file and printer sharing suite. In particular, these vulnerabilities affect to SWAT, the Samba Web Administration Tool.

  - CVE-2013-0213: Clickjacking issue in SWAT     An attacker can integrate a SWAT page into a malicious     web page via a frame or iframe and then overlaid by     other content. If an authenticated valid user interacts     with this malicious web page, she might perform     unintended changes in the Samba settings.

  - CVE-2013-0214: Potential Cross-site request forgery     An attacker can persuade a valid SWAT user, who is     logged in as root, to click in a malicious link and     trigger arbitrary unintended changes in the Samba     settings. In order to be vulnerable, the attacker needs     to know the victim's password.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1542 advisory.

    - resolves: #1015359 - Fix CVE-2013-0213 and CVE-2013-0214 in SWAT.
    - resolves: #984808 - CVE-2013-4124: DoS via integer overflow when reading                           an EA list

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated samba3x packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.
(CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba server.

Red Hat would like to thank the Samba project for reporting CVE-2013-0213 and CVE-2013-0214. Upstream acknowledges Jann Horn as the original reporter of CVE-2013-0213 and CVE-2013-0214.

These updated samba3x packages also include numerous bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 5.10 Technical Notes, linked to in the References, for information on the most significant of these changes.

All samba3x users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

Updated samba packages that fix three security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.
(CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba server.

Red Hat would like to thank the Samba project for reporting CVE-2013-0213 and CVE-2013-0214. Upstream acknowledges Jann Horn as the original reporter of CVE-2013-0213 and CVE-2013-0214.

These updated samba packages include numerous bug fixes and one enhancement. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes.

All samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. After installing this update, the smb service will be restarted automatically.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
83623	SUSE SLES11 Security Update : Samba (SUSE-SU-2014:0723-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
89777	Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2922-1)	Nessus	Ubuntu Local Security Checks	2016/3/9	2025/9/3	medium
83575	SUSE SLED10 / SLES10 Security Update : Samba (SUSE-SU-2013:0325-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	medium
64459	Samba < 3.5.21 / 3.6.12 / 4.0.2 SWAT Multiple Vulnerabilities	Nessus	Misc.	2013/2/4	2018/11/15	medium
64862	SuSE 11.2 Security Update : Samba (SAT Patch Number 7292)	Nessus	SuSE Local Security Checks	2013/2/24	2021/1/19	medium
70346	Oracle Linux 5 : samba3x (ELSA-2013-1310)	Nessus	Oracle Linux Local Security Checks	2013/10/9	2024/10/22	high
70390	Scientific Linux Security Update : samba3x on SL5.x i386/x86_64 (20130930)	Nessus	Scientific Linux Local Security Checks	2013/10/11	2021/1/14	medium
71201	Scientific Linux Security Update : samba on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	2013/12/4	2021/1/14	medium
73063	CentOS 5 : samba (CESA-2014:0305)	Nessus	CentOS Local Security Checks	2014/3/18	2021/1/4	medium
73072	RHEL 5 : samba (RHSA-2014:0305)	Nessus	Red Hat Local Security Checks	2014/3/18	2021/1/14	medium
290139	MiracleLinux 4 : samba-3.6.9-167.AXS4 (AXSA:2014-033:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
64397	Debian DSA-2617-1 : samba - several issues	Nessus	Debian Local Security Checks	2013/2/4	2021/1/11	medium
71103	Oracle Linux 6 : samba (ELSA-2013-1542)	Nessus	Oracle Linux Local Security Checks	2013/11/27	2025/4/29	high
79150	CentOS 5 : samba3x (CESA-2013:1310)	Nessus	CentOS Local Security Checks	2014/11/12	2021/1/4	medium
79159	CentOS 6 : samba (CESA-2013:1542)	Nessus	CentOS Local Security Checks	2014/11/12	2021/1/4	medium

检测

插件搜索

high

critical

medium

medium

medium

medium

high

medium

medium

medium

medium

high

medium

high

medium

medium