Updated samba4 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in the DCE-RPC client code in Samba. A specially crafted DCE-RPC packet could cause various Samba programs to crash or, possibly, execute arbitrary code when parsed. A malicious or compromised Active Directory Domain Controller could use this flaw to compromise the winbindd daemon running with root privileges. (CVE-2013-4408)

Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Stefan Metzmacher and Michael Adam of SerNet as the original reporters of this issue.

All users of Samba are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the smb service will be restarted automatically.

This updates Samba to version 4.0.13, which fixes two security bugs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Winbind incorrectly handled invalid group names with the require_membership_of parameter. If an administrator used an invalid group name by mistake, access was granted instead of having the login fail. (CVE-2012-6150)

Stefan Metzmacher and Michael Adam discovered that Samba incorrectly handled DCE-RPC fragment length fields. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code as the root user. (CVE-2013-4408)

Hemanth Thummala discovered that Samba incorrectly handled file permissions when vfs_streams_depot or vfs_streams_xattr were enabled.
A remote attacker could use this issue to bypass intended restrictions. (CVE-2013-4475).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in samba :

The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake (CVE-2012-6150).

Buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet (CVE-2013-4408).

The updated packages has been upgraded to the 3.6.22 version which resolves various upstream bugs and is not vulnerable to these issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-032:01 advisory.

    Samba is the standard Windows interoperability suite of programs for Linux and U nix.
    Security issues fixed with this release:
     CVE-2013-4124     Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22,     3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory     consumption) via a malformed packet.
     CVE-2013-4408     Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in     winbindd in Samba 3.x before 3.6.22, 4.0.x before 4.0.13, and 4.1.x before 4.1.3 allows remote AD domain     controllers to execute arbitrary code via an invalid fragment length in a DCE-RPC packet.
    Fixed bugs:
     When installing Samba in the build root directory, f the RPM target did not exist, then the find-     debuginfo.sh script did not create symbolic links for the libwbclient.so.debug module associated with the     target. This has been fixed: the paths are now relative and the links are created.
     Added a missing dependency for the libreplace.so which could prevent the installation.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes these security vulnerabilities :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2114: 'server signing = mandatory' not enforced     (bsc#973035).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

The openSUSE 13.1 update also upgrades to samba 4.2.4 as 4.1.x versions are no longer supported by upstream. As a side effect, libpdb0 package was replaced by libsamba-passdb0.

Update to Samba 4.1.9. Update to Samba 4.1.8 (CVE-2014-0178 samba:
Uninitialized memory exposure)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Samba project reports :

These are security releases in order to address CVE-2013-4408 (DCE-RPC fragment length field is incorrectly checked) and CVE-2012-6150 (pam_winbind login without require_membership_of restrictions).

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1805 advisory.

    - resolves: #1018039 - Fix CVE-2013-4408.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Two security issues were found in Samba, a SMB/CIFS file, print, and login server :

  - CVE-2013-4408     It was discovered that multiple buffer overflows in the     processing of DCE-RPC packets may lead to the execution     of arbitrary code.

  - CVE-2013-4475     Hemanth Thummala discovered that ACLs were not checked     when opening files with alternate data streams. This     issue is only exploitable if the VFS modules     vfs_streams_depot and/or vfs_streams_xattr are used.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1806 advisory.

    - resolves: #1018037 - Fix CVE-2013-4408.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following security issues with samba :

  - DCERPC frag_len not checked. (CVE-2013-4408).
    (bnc#844720)

  - winbind pam security problem. (CVE-2012-6150).
    (bnc#853347)

  - No access check verification on stream files     (CVE-2013-4475). And fixes the following non-security     issues :. (bnc#848101)

  - libsmbclient0 package description contains comments.
    (bnc#853021)

  - rpcclient adddriver and setdrive do not set all needed     registry entries. (bnc#817880)

  - Client trying to delete print job fails: Samba returns:
    WERR_INVALID_PRINTER_NAME. (bnc#838472)

  - various upstream fixes. (bnc#854520 and bnc#849226)

This is a LTSS roll-up update for the Samba Server suite fixing multiple security issues and bugs.

Security issues fixed :

  - CVE-2013-4496: Password lockout was not enforced for     SAMR password changes, leading to brute force     possibility.

  - CVE-2013-4408: DCE-RPC fragment length field is     incorrectly checked.

  - CVE-2013-4124: Samba was affected by a denial of service     attack on authenticated or guest connections.

  - CVE-2013-0214: The SWAT webadministration was affected     by a cross site scripting attack (XSS).

  - CVE-2013-0213: The SWAT webadministration could possibly     be used in clickjacking attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
71273	CentOS 6 : samba4 (CESA-2013:1805)	Nessus	CentOS Local Security Checks	2013/12/10	2021/1/4	high
71447	Fedora 19 : samba-4.0.13-1.fc19 (2013-23085)	Nessus	Fedora Local Security Checks	2013/12/16	2021/1/11	high
71376	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 / 13.10 : samba vulnerabilities (USN-2054-1)	Nessus	Ubuntu Local Security Checks	2013/12/12	2019/9/19	high
71606	Mandriva Linux Security Advisory : samba (MDVSA-2013:299)	Nessus	Mandriva Local Security Checks	2013/12/23	2021/1/6	high
290091	MiracleLinux 4 : samba4-4.0.0-60.AXS4.rc4 (AXSA:2014-032:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
90609	openSUSE Security Update : samba (openSUSE-2016-490) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/21	2021/1/19	high
76223	Fedora 20 : samba-4.1.9-3.fc20 (2014-7672)	Nessus	Fedora Local Security Checks	2014/6/26	2021/1/11	high
71285	FreeBSD : samba -- multiple vulnerabilities (613e45d1-6154-11e3-9b62-000c292e4fd8)	Nessus	FreeBSD Local Security Checks	2013/12/10	2021/1/6	high
71288	Oracle Linux 6 : samba4 (ELSA-2013-1805)	Nessus	Oracle Linux Local Security Checks	2013/12/10	2024/10/22	critical
71275	Debian DSA-2812-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	2013/12/10	2021/1/11	high
71289	Oracle Linux 5 / 6 : samba / and / samba3x (ELSA-2013-1806)	Nessus	Oracle Linux Local Security Checks	2013/12/10	2024/10/22	critical
71833	SuSE 11.2 / 11.3 Security Update : Samba (SAT Patch Numbers 8655 / 8656)	Nessus	SuSE Local Security Checks	2014/1/7	2021/1/19	high
83623	SUSE SLES11 Security Update : Samba (SUSE-SU-2014:0723-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical

检测

插件搜索

high

high

high

high

high

high

high

high

critical

high

critical

high

high

critical