According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in Samba's DCE/RPC protocol     implementation. A remote, authenticated attacker could     use these flaws to cause a denial of service against     the Samba server (high CPU load or a crash) or,     possibly, execute arbitrary code with the permissions     of the user running Samba (root). This flaw could also     be used to downgrade a secure DCE/RPC connection by a     man-in-the-middle attacker taking control of an Active     Directory (AD) object and compromising the security of     a Samba Active Directory Domain Controller     (DC).(CVE-2015-5370)

  - A protocol flaw, publicly referred to as Badlock, was     found in the Security Account Manager Remote Protocol     (MS-SAMR) and the Local Security Authority (Domain     Policy) Remote Protocol (MS-LSAD). Any authenticated     DCE/RPC connection that a client initiates against a     server could be used by a man-in-the-middle attacker to     impersonate the authenticated user against the SAMR or     LSA service on the server.

  - As a result, the attacker would be able to get     read/write access to the Security Account Manager     database, and use this to reveal all passwords or any     other potentially sensitive information in that     database. (CVE-2016-2118)

  - Several flaws were found in Samba's implementation of     NTLMSSP authentication. An nauthenticated,     man-in-the-middle attacker could use this flaw to clear     the encryption and integrity flags of a connection,     causing data to be transmitted in plain text. The     attacker could also force the client or server into     sending data in plain text even if encryption was     explicitly requested for that     connection.(CVE-2016-2110)

  - It was discovered that Samba configured as a Domain     Controller would establish a secure communication     channel with a machine using a spoofed computer name. A     remote attacker able to observe network traffic could     use this flaw to obtain session-related information     about the spoofed machine. (CVE-2016-2111)

  - It was found that Samba's LDAP implementation did not     enforce integrity protection for LDAP connections. A     man-in-the-middle attacker could use this flaw to     downgrade LDAP connections to use no integrity     protection, allowing them to hijack such     connections.(CVE-2016-2112)

  - It was found that Samba did not validate SSL/TLS     certificates in certain connections. A     man-in-the-middle attacker could use this flaw to spoof     a Samba server using a specially crafted SSL/TLS     certificate.(CVE-2016-2113)

  - It was discovered that Samba did not enforce Server     Message Block (SMB) signing for clients using the SMB1     protocol. A man-in-the-middle attacker could use this     flaw to modify traffic between a client and a server.
    (CVE-2016-2114)

  - It was found that Samba did not enable integrity     protection for IPC traffic by default. A     man-in-the-middle attacker could use this flaw to view     and modify the data sent between a Samba server and a     client.(CVE-2016-2115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-209:01 advisory.

    ipa     IPA is an integrated solution to provide centrally managed Identity (machine,     user, virtual machines, groups, authentication credentials), Policy     (configuration settings, access control information) and Audit (events,     logs, analysis thereof).
    libldb     An extensible library that implements an LDAP like API to access remote LDAP     servers, or use local tdb databases.
    libtalloc     A library that implements a hierarchical allocator with destructors.
    libtdb     A library that implements a trivial database.
    libtevent     Tevent is an event system based on the talloc memory management library.
    Tevent has support for many event types, including timers, signals, and     the classic file descriptor events.
    Tevent also provide helpers to deal with asynchronous code providing the     tevent_req (Tevent Request) functions.
    openchange     OpenChange provides libraries to access Microsoft Exchange servers     using native protocols.
    samba4     Samba is the standard Windows interoperability suite of programs for Linux and Unix.
    Security issues fixed with this release:
    CVE-2015-5370
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-2110
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-2111
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-2112
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-2113
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-2114
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-2115
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-2118
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    The following packages have been upgraded to a newer upstream version: Samba (4.2.10). Refer to the     Release Notes listed in the References section for a complete list of changes.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple flaws were found in Samba's DCE/RPC protocol implementation.
A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC).
(CVE-2015-5370)

A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server.
As a result, the attacker would be able to get read/write access to the Security Account Manager database, and use this to reveal all passwords or any other potentially sensitive information in that database. (CVE-2016-2118)

Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection.
(CVE-2016-2110)

It was discovered that Samba configured as a Domain Controller would establish a secure communication channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111)

It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections.
(CVE-2016-2112)

It was found that Samba did not validate SSL/TLS certificates in certain connections. A man-in-the-middle attacker could use this flaw to spoof a Samba server using a specially crafted SSL/TLS certificate.
(CVE-2016-2113)

It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a server. (CVE-2016-2114)

It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Security fix for CVE-2015-5370, CVE-2016-2110, CVE-2016-2111, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, CVE-2016-2115, CVE-2016-2118

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for samba4 and samba is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7, respectively.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a newer upstream version:
Samba (4.2.10). Refer to the Release Notes listed in the References section for a complete list of changes.

Security Fix(es) :

* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC).
(CVE-2015-5370)

Note: While Samba packages as shipped in Red Hat Enterprise Linux do not support running Samba as an AD DC, this flaw applies to all roles Samba implements.

* A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server.
As a result, the attacker would be able to get read/write access to the Security Account Manager database, and use this to reveal all passwords or any other potentially sensitive information in that database. (CVE-2016-2118)

* Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection.
(CVE-2016-2110)

* It was discovered that Samba configured as a Domain Controller would establish a secure communication channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111)

* It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections.
(CVE-2016-2112)

* It was found that Samba did not validate SSL/TLS certificates in certain connections. A man-in-the-middle attacker could use this flaw to spoof a Samba server using a specially crafted SSL/TLS certificate.
(CVE-2016-2113)

* It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a server. (CVE-2016-2114)

* It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Jouni Knuutinen (Synopsis) as the original reporter of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the original reporter of CVE-2016-2118, CVE-2016-2110, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, and CVE-2016-2115.

Samba team reports :

[CVE-2015-5370] Errors in Samba DCE-RPC code can lead to denial of service (crashes and high cpu consumption) and man in the middle attacks.

[CVE-2016-2110] The feature negotiation of NTLMSSP is not downgrade protected. A man in the middle is able to clear even required flags, especially NTLMSSP_NEGOTIATE_SIGN and NTLMSSP_NEGOTIATE_SEAL.

[CVE-2016-2111] When Samba is configured as Domain Controller it allows remote attackers to spoof the computer name of a secure channel's endpoints, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic.

[CVE-2016-2112] A man in the middle is able to downgrade LDAP connections to no integrity protection.

[CVE-2016-2113] Man in the middle attacks are possible for client triggered LDAP connections (with ldaps://) and ncacn_http connections (with https://).

[CVE-2016-2114] Due to a bug Samba doesn't enforce required smb signing, even if explicitly configured.

[CVE-2016-2115] The protection of DCERPC communication over ncacn_np (which is the default for most the file server related protocols) is inherited from the underlying SMB connection.

[CVE-2016-2118] a.k.a. BADLOCK. A man in the middle can intercept any DCERPC traffic between a client and a server in order to impersonate the client and get the same privileges as the authenticated user account. This is most problematic against active directory domain controllers.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0612 advisory.

    ipa     [4.2.0-15.0.1.6.1]
    - Drop redhat-access-plugin-ipa requires for OL7       Blank out header-logo.png product-name.png       Replace login-screen-logo.png [20362818]

    [4.2.0-15.6.1]
    - Rebuild against newer Samba version
    - Related: #1322690

    libldb     [1.1.25-1]
    - Rebase libldb to 1.1.25
    - Related: rhbz#1322690

    libtalloc     [2.1.5-1]
    - Rebase to libtalloc 2.1.5
    - Related: rhbz#1322690

    libtdb     [1.3.8-1]
    - Rebase libtdb to 1.3.8
    - Related: rhbz#1322690

    libtevent     [0.9.26-1]
    - Rebase libtevent to 0.9.26
    - Related: rhbz#1322690

    openchange     [2.0-10]
    - Add a patch to fix connection string (Related: #1322690)

    samba     [4.2.10-6]
    - Fix domain member winbind not being able to talk to trusted domains' DCs
    - relates: #1322690

    [4.2.10-5]
    - Fix crash in smb.conf processing
    - relates: #1322690

    [4.2.10-4]
    - Fix LDAP SASL bind with arcfour-hmac-md5
    - resolves: #1322690

    [4.2.10-3]
    - Make sure the package owns /var/lib/samba and uses it for cache purposes
    - resolves: #1322690

    [4.2.10-2]
    - Remove ldb modules and internal libraries for DC when not packaging DC build
    - resolves: #1322690

    [4.2.10-1]
    - resolves: #1322690

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

samba was updated to fix seven security issues.

These security issues were fixed :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

These non-security issues were fixed :

  - bsc#974629: Fix samba.tests.messaging test and prevent     potential tdb corruption by removing obsolete now     invalid tdb_close call.

  - bsc#973832: Obsolete libsmbsharemodes0 from samba-libs     and libsmbsharemodes-devel from samba-core-devel.

  - bsc#972197: Obsolete libsmbclient from libsmbclient0 and     libpdb-devel from libsamba-passdb-devel while not     providing it.

  - Getting and setting Windows ACLs on symlinks can change     permissions on link

  - bsc#924519: Upgrade on-disk FSRVP server state to new     version.

  - bsc#968973: Only obsolete but do not provide gplv2/3     package names.

  - bso#6482: s3:utils/smbget: Fix recursive download.

  - bso#10489: s3: smbd: posix_acls: Fix check for setting     u:g:o entry on a filesystem with no ACL support.

  - bso#11643: docs: Add example for domain logins to     smbspool man page.

  - bso#11690: s3-client: Add a KRB5 wrapper for smbspool.

  - bso#11708: loadparm: Fix memory leak issue.

  - bso#11714: lib/tsocket: Work around sockets not     supporting FIONREAD.

  - bso#11719: ctdb-scripts: Drop use of 'smbcontrol     winbindd ip-dropped ...'.

  - bso#11727: s3:smbd:open: Skip redundant call to     file_set_dosmode when creating a new file.

  - bso#11732: param: Fix str_list_v3 to accept ';' again.

  - bso#11740: Real memeory leak(buildup) issue in loadparm.

This update was imported from the SUSE:SLE-12-SP1:Update update project.

An update for samba is now available for Red Hat Gluster Storage 3.1 for RHEL 6 and Red Hat Gluster Storage 3.1 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a newer upstream version:
Samba (4.2.10). Refer to the Release Notes listed in the References section for a complete list of changes.

Security Fix(es) :

* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC).
(CVE-2015-5370)

Note: While Samba packages as shipped in Red Hat Gluster Storage do not support running Samba as an AD DC, this flaw applies to all roles Samba implements.

* A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server.
As a result, the attacker would be able to get read/write access to the Security Account Manager database, and use this to reveal all passwords or any other potentially sensitive information in that database. (CVE-2016-2118)

* Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection.
(CVE-2016-2110)

* It was discovered that Samba configured as a Domain Controller would establish a secure communication channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111)

* It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections.
(CVE-2016-2112)

* It was found that Samba did not validate SSL/TLS certificates in certain connections. A man-in-the-middle attacker could use this flaw to spoof a Samba server using a specially crafted SSL/TLS certificate.
(CVE-2016-2113)

* It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a server. (CVE-2016-2114)

* It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Jouni Knuutinen (Synopsis) as the original reporter of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the original reporter of CVE-2016-2118, CVE-2016-2110, CVE-2016-2112, CVE-2016-2113, CVE-2016-2114, and CVE-2016-2115.

samba was updated to fix seven security issues.

These security issues were fixed :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-47 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with root       privileges, cause a Denial of Service condition, conduct a       man-in-the-middle attack, obtain sensitive information, or bypass file       permissions.
  Workaround :

    There is no known workaround at this time.

This update fixes these security vulnerabilities :

  - CVE-2015-5370: DCERPC server and client were vulnerable     to DOS and MITM attacks (bsc#936862).

  - CVE-2016-2110: A man-in-the-middle could have downgraded     NTLMSSP authentication (bsc#973031).

  - CVE-2016-2111: Domain controller netlogon member     computer could have been spoofed (bsc#973032).

  - CVE-2016-2112: LDAP conenctions were vulnerable to     downgrade and MITM attack (bsc#973033).

  - CVE-2016-2113: TLS certificate validation were missing     (bsc#973034).

  - CVE-2016-2114: 'server signing = mandatory' not enforced     (bsc#973035).

  - CVE-2016-2115: Named pipe IPC were vulnerable to MITM     attacks (bsc#973036).

  - CVE-2016-2118: 'Badlock' DCERPC impersonation of     authenticated account were possible (bsc#971965).

The openSUSE 13.1 update also upgrades to samba 4.2.4 as 4.1.x versions are no longer supported by upstream. As a side effect, libpdb0 package was replaced by libsamba-passdb0.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99777	EulerOS 2.0 SP1 : samba (EulerOS-SA-2016-1014)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/23	high
289882	MiracleLinux 4 : samba4-4.2.10-6.AXS4 (AXSA:2016-209:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
90514	Amazon Linux AMI : samba (ALAS-2016-686) (Badlock)	Nessus	Amazon Linux Local Security Checks	2016/4/14	2019/7/10	high
90646	Fedora 24 : samba-4.4.2-1.fc24 (2016-383fce04e2) (Badlock)	Nessus	Fedora Local Security Checks	2016/4/22	2021/1/11	high
90450	CentOS 6 / 7 : ipa / libldb / libtalloc / libtdb / libtevent / openchange / samba / samba4 (CESA-2016:0612) (Badlock)	Nessus	CentOS Local Security Checks	2016/4/13	2021/1/4	high
90474	FreeBSD : samba -- multiple vulnerabilities (a636fc26-00d9-11e6-b704-000c292e4fd8) (Badlock)	Nessus	FreeBSD Local Security Checks	2016/4/13	2021/1/4	high
90487	Oracle Linux 6 / 7 : samba / and / samba4 (ELSA-2016-0612)	Nessus	Oracle Linux Local Security Checks	2016/4/13	2024/11/1	high
90492	RHEL 6 / 7 : samba and samba4 (RHSA-2016:0612) (Badlock)	Nessus	Red Hat Local Security Checks	2016/4/13	2019/10/24	high
90519	Fedora 23 : samba-4.3.8-0.fc23 (2016-be53260726) (Badlock)	Nessus	Fedora Local Security Checks	2016/4/14	2021/1/11	high
90522	openSUSE Security Update : samba (openSUSE-2016-453) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/14	2021/1/19	high
90530	RHEL 6 / 7 : Storage Server (RHSA-2016:0614) (Badlock)	Nessus	Red Hat Local Security Checks	2016/4/15	2019/10/24	high
90534	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2016:1024-1) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/15	2021/1/6	high
96127	GLSA-201612-47 : Samba: Multiple vulnerabilities (Badlock)	Nessus	Gentoo Local Security Checks	2016/12/27	2026/1/7	high
90609	openSUSE Security Update : samba (openSUSE-2016-490) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/21	2021/1/19	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high