Server memory information leak over SMB1 :

An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)

SMB2 connections don't keep encryption across DFS redirects

A flaw was found in the way samba client used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack. (CVE-2017-12151)

Some code path don't enforce smb signing, when they should

It was found that samba did not enforce 'SMB signing' when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
(CVE-2017-12150)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x     before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory     contents to a file on the samba share or to a shared printer, though the exact area of server memory     cannot be controlled by the attacker. (CVE-2017-12163)

Note that Nessus relies on the presence of the package as reported by the vendor.

執行 MAIN 4.05 版的遠端 NewStart CGSL 主機安裝了受多個弱點影響的 samba 套件：- 在 samba 伺服器中發現爭用情形。惡意 samba 用戶端可利用此缺陷，存取不在共用定義下匯出之伺服器檔案系統範圍內的檔案和目錄。(CVE-2017-2619) - 在 Samba 實作 SMB1 通訊協定的方式中發現資訊洩漏缺陷。雖然攻擊者無法控制伺服器記憶體的實際區域，但是惡意用戶端還是可利用此缺陷，將伺服器記憶體內容傾印到 samba 共用上的檔案或共用印表機。(CVE-2017-12163) - 據發現，在啟用某些組態選項時，samba 並不會強制執行 SMB 簽署。遠端攻擊者可啟動攔截式攻擊並且擷取純文字中的資訊。(CVE-2017-12150) 請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

現已提供適用於 Red Hat Enterprise Linux 7 的 samba 更新。Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。Samba 是伺服器訊息區 (SMB) 通訊協定與相關 Common Internet File System (CIFS) 通訊協定的開放原始碼實作，可讓 PC 相容電腦共用檔案、印表機和多種資訊。安全性修正：據發現，在啟用某些組態選項時，samba 並不會強制執行「SMB 簽署」。遠端攻擊者可啟動攔截式攻擊並且擷取純文字中的資訊。(CVE-2017-12150) * 當最大通訊協定設定為 SMB3，在 samba 用戶端使用加密的方式中發現缺陷。連線可能會遺失簽署和加密任何 DFS 重新導向的需求，讓攻擊者得以透過攔截式攻擊讀取或更改連線內容。(CVE-2017-12151) * 在 Samba 實作 SMB1 通訊協定的方式中發現資訊洩漏缺陷。雖然攻擊者無法控制伺服器記憶體的實際區域，但是惡意用戶端還是可利用此缺陷，將伺服器記憶體內容傾印到 samba 共用上的檔案或共用印表機。(CVE-2017-12163) Red Hat 感謝 Samba 專案報告 CVE-2017-12150 和 CVE-2017-12151，以及 Yihan Lian 和 Zhibin Hu (Qihoo 360 GearTeam)、Stefan Metzmacher (SerNet) 和 Jeremy Allison (Google) 報告 CVE-2017-12163。上游確認 Stefan Metzmacher (SerNet) 是 CVE-2017-12150 和 CVE-2017-12151 的原始報告者。

安全性修正：- 據發現，在啟用某些組態選項時，samba 並不會強制執行「SMB 簽署」。遠端攻擊者可啟動攔截式攻擊並且擷取純文字中的資訊。(CVE-2017-12150) - 當最大通訊協定設定為 SMB3，在 samba 用戶端使用加密的方式中發現缺陷。連線可能會遺失簽署和加密任何 DFS 重新導向的需求，讓攻擊者得以透過攔截式攻擊讀取或更改連線內容。(CVE-2017-12151) - 在 Samba 實作 SMB1 通訊協定的方式中發現資訊洩漏缺陷。雖然攻擊者無法控制伺服器記憶體的實際區域，但是惡意用戶端還是可利用此缺陷，將伺服器記憶體內容傾印到 samba 共用上的檔案或共用印表機。(CVE-2017-12163)

來自 Red Hat 安全公告 2017:2791： 現已提供適用於 Red Hat Enterprise Linux 6 的 samba4 更新。 Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。 Samba 是伺服器訊息區 (SMB) 或 Common Internet File System (CIFS) 通訊協定的開放原始碼實作，可讓 PC 相容電腦共用檔案、印表機和其他資訊。 安全性修正： * 據發現，在啟用某些組態選項時，samba 並不會強制執行「SMB 簽名」。遠端攻擊者可啟動攔截式攻擊並且擷取純文字中的資訊。 (CVE-2017-12150) * 在 Samba 實作 SMB1 通訊協定的方式中發現資訊洩漏缺陷。雖然攻擊者無法控制伺服器記憶體的實際區域，但是惡意用戶端還是可利用此缺陷，將伺服器記憶體內容傾印到 samba 共用上的檔案或共用印表機。(CVE-2017-12163) Red Hat 感謝 Samba 專案通報 CVE-2017-12150，感謝 Yihan Lian 和 Zhibin Hu (Qihoo 360 GearTeam)、Stefan Metzmacher (SerNet) 和 Jeremy Allison (Google) 通報 CVE-2017-12163。上游確認 Stefan Metzmacher (SerNet) 是 CVE-2017-12150 的原始報告者。

安全性修正：- 在 samba 伺服器中發現爭用情形。惡意 samba 用戶端可利用此缺陷，存取不在共用定義下匯出之伺服器檔案系統範圍內的檔案和目錄。(CVE-2017-2619) - 據發現，在啟用某些組態選項時，samba 並不會強制執行「SMB 簽署」。遠端攻擊者可啟動攔截式攻擊並且擷取純文字中的資訊。(CVE-2017-12150) - 在 Samba 實作 SMB1 通訊協定的方式中發現資訊洩漏缺陷。雖然攻擊者無法控制伺服器記憶體的實際區域，但是惡意用戶端還是可利用此缺陷，將伺服器記憶體內容傾印到 samba 共用上的檔案或共用印表機。(CVE-2017-12163)

An update for samba4 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

Security Fix(es) :

* It was found that samba did not enforce 'SMB signing' when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
(CVE-2017-12150)

* An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)

Red Hat would like to thank the Samba project for reporting CVE-2017-12150 and Yihan Lian and Zhibin Hu (Qihoo 360 GearTeam), Stefan Metzmacher (SerNet), and Jeremy Allison (Google) for reporting CVE-2017-12163. Upstream acknowledges Stefan Metzmacher (SerNet) as the original reporter of CVE-2017-12150.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes several issues. These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624)

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for samba4 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

Security Fix(es) :

* It was found that samba did not enforce 'SMB signing' when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
(CVE-2017-12150)

* An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)

Red Hat would like to thank the Samba project for reporting CVE-2017-12150 and Yihan Lian and Zhibin Hu (Qihoo 360 GearTeam), Stefan Metzmacher (SerNet), and Jeremy Allison (Google) for reporting CVE-2017-12163. Upstream acknowledges Stefan Metzmacher (SerNet) as the original reporter of CVE-2017-12150.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2789 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * A race condition was found in samba server. A malicious samba client could use this flaw to access files     and directories in areas of the server file system not exported under the share definitions.
    (CVE-2017-2619)

    * It was found that samba did not enforce SMB signing when certain configuration options were enabled. A     remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
    (CVE-2017-12150)

    * An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client     could use this flaw to dump server memory contents to a file on the samba share or to a shared printer,     though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)

    Red Hat would like to thank the Samba project for reporting CVE-2017-2619 and CVE-2017-12150 and Yihan     Lian and Zhibin Hu (Qihoo 360 GearTeam), Stefan Metzmacher (SerNet), and Jeremy Allison (Google) for     reporting CVE-2017-12163. Upstream acknowledges Jann Horn (Google) as the original reporter of     CVE-2017-2619; and Stefan Metzmacher (SerNet) as the original reporter of CVE-2017-12150.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been discoverd in Samba, a SMB/CIFS file, print, and login server for Unix :

  - CVE-2017-12150     Stefan Metzmacher discovered multiple code paths where     SMB signing was not enforced.

  - CVE-2017-12151     Stefan Metzmacher discovered that tools using     libsmbclient did not enforce encryption when following     DFS redirects, which could allow a man-in-the-middle     attacker to read or modify connections which were meant     to be encrypted.

  - CVE-2017-12163     Yihan Lian and Zhibin Hu discovered that insufficient     range checks in the processing of SMB1 write requests     could result in disclosure of server memory.

Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2789 advisory.

    [3.6.23-45.0.1]
    - Remove use-after-free talloc_tos() inlined function problem (John Haxby) [orabug 18253258]

    [3.6.24-45]
    - resolves: #1491210 - CVE-2017-2619 CVE-2017-12150 CVE-2017-12163

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for samba fixes the following issues :

Security issues fixed :

  - CVE-2017-14746: Use-after-free vulnerability     (bsc#1060427).

  - CVE-2017-15275: Server heap memory information leak     (bsc#1063008).

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file (bsc#1058624).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

  - CVE-2017-12150: Some code path don't enforce smb signing     when they should (bsc#1058565).

Bug fixes :

  - Samba was updated to 4.6.9 (bsc#1065066) see release     notes for details.

  - https://www.samba.org/samba/history/samba-4.6.9.html

This update was imported from the SUSE:SLE-12-SP3:Update update project.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that samba did not enforce 'SMB signing'     when certain configuration options were enabled. A     remote attacker could launch a man-in-the-middle attack     and retrieve information in plain-text.
    (CVE-2017-12150)

  - A flaw was found in the way samba client used     encryption with the max protocol set as SMB3. The     connection could lose the requirement for signing and     encrypting to any DFS redirects, allowing an attacker     to read or alter the contents of the connection via a     man-in-the-middle attack. (CVE-2017-12151)

  - An information leak flaw was found in the way SMB1     protocol was implemented by Samba. A malicious client     could use this flaw to dump server memory contents to a     file on the samba share or to a shared printer, though     the exact area of server memory cannot be controlled by     the attacker. (CVE-2017-12163)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes several issues. These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624)

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622)

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
103822	Amazon Linux AMI : samba (ALAS-2017-909)	Nessus	Amazon Linux Local Security Checks	2017/10/13	2018/10/1	high
220415	Linux Distros Unpatched Vulnerability : CVE-2017-12163	Nessus	Misc.	2025/3/4	2025/3/4	high
127352	NewStart CGSL MAIN 4.05：samba 多個弱點 (NS-SA-2019-0113)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
103407	RHEL 7：samba (RHSA-2017:2790)	Nessus	Red Hat Local Security Checks	2017/9/22	2025/2/18	critical
103411	Scientific Linux 安全性更新：SL7.x x86_64 上的 samba	Nessus	Scientific Linux Local Security Checks	2017/9/22	2021/1/14	high
103491	Oracle Linux 6 : samba4 (ELSA-2017-2791)	Nessus	Oracle Linux Local Security Checks	2017/9/27	2024/10/22	high
103501	Scientific Linux 安全性更新：SL6.x i386/x86_64 上的 samba	Nessus	Scientific Linux Local Security Checks	2017/9/27	2021/1/14	high
119227	Virtuozzo 6 : samba4 / samba4-client / samba4-common / samba4-dc / etc (VZLSA-2017-2791)	Nessus	Virtuozzo Local Security Checks	2018/11/27	2024/7/18	high
103832	SUSE SLES11 Security Update : samba (SUSE-SU-2017:2715-1)	Nessus	SuSE Local Security Checks	2017/10/13	2021/1/19	high
103387	CentOS 6 : samba4 (CESA-2017:2791)	Nessus	CentOS Local Security Checks	2017/9/22	2021/1/4	high
103406	RHEL 6 : samba (RHSA-2017:2789)	Nessus	Red Hat Local Security Checks	2017/9/22	2024/11/5	high
103432	Debian DSA-3983-1 : samba - security update	Nessus	Debian Local Security Checks	2017/9/25	2021/1/4	high
103434	Fedora 26 : 2:samba (2017-5a0a31c04e)	Nessus	Fedora Local Security Checks	2017/9/25	2021/1/6	high
103489	Oracle Linux 6 : samba (ELSA-2017-2789)	Nessus	Oracle Linux Local Security Checks	2017/9/27	2024/10/22	high
105218	openSUSE Security Update : samba (openSUSE-2017-1316)	Nessus	SuSE Local Security Checks	2017/12/14	2021/1/19	critical
103735	EulerOS 2.0 SP1 : samba (EulerOS-SA-2017-1233)	Nessus	Huawei Local Security Checks	2017/10/10	2021/1/6	high
103770	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:2695-1)	Nessus	SuSE Local Security Checks	2017/10/11	2021/1/6	high
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical

检测

插件搜索

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

critical

high

high

critical