The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2789 advisory.

    [3.6.23-45.0.1]
    - Remove use-after-free talloc_tos() inlined function problem (John Haxby) [orabug 18253258]

    [3.6.24-45]
    - resolves: #1491210 - CVE-2017-2619 CVE-2017-12150 CVE-2017-12163

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125)

* A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126)

* A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions.
(CVE-2017-2619)

Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1265 advisory.

    [4.4.4-13]
    - resolves: #1437816 - Fix krb5 memory cache in libads sasl code
    - resolves: #1437741 - Fix CVE-2016-2125, CVE-2016-2126 and CVE-2017-2619

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to     allow access to areas of the server file system not exported under the share definition. (CVE-2017-2619)

Note that Nessus relies on the presence of the package as reported by the vendor.

Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacker could use this issue to access files on the server outside of the exported directories.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jann Horn of Google discovered a time-of-check, time-of-use race condition in Samba, a SMB/CIFS file, print, and login server for Unix.
A malicious client can take advantage of this flaw by exploiting a symlink race to access areas of the server file system not exported under a share definition.

This update for samba fixes the following issues :

Security issues fixed :

  - CVE-2017-2619: Symlink race permits opening files     outside share directory (bsc#1027147).

Bugfixes :

  - Don't package man pages for VFS modules that aren't     built (bsc#993707).

  - sync_req: make async_connect_send() 'reentrant';
    (bso#12105); (bsc#1024416).

  - Document 'winbind: ignore domains' parameter;
    (bsc#1019416).

  - Prevent core, make sure response->extra_data.data is     always cleared out; (bsc#993692).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. (CVE-2016-2125)

* A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process. (CVE-2016-2126)

* A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions.
(CVE-2017-2619)

Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.

According to its self-reported version number, the remote Junos Space version is 18.4.x prior to 18.4R1. It is, therefore, affected by multiple vulnerabilities : 

  - An integer overflow issue exists in procps-ng. This is     related to CVE-2018-1124. (CVE-2018-1126)

  - A directory traversal issue exits in reposync, a part     of yum-utils.tory configuration files. If an attacker     controls a repository, they may be able to copy files     outside of the destination directory on the targeted     system via path traversal. (CVE-2018-10897)

  - An integer overflow flaw was found in the Linux     kernel's create_elf_tables() function. An unprivileged     local user with access to SUID binary could use this     flaw to escalate their privileges on the system.
    (CVE-2018-14634)

Additionally, Junos Space is affected by several other vulnerabilities exist as noted in the vendor advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Samba 4.4.x prior to 4.4.12, 4.5.x prior to 4.5.7, and 4.6.x prior to 4.6.1 are unpatched, and therefore affected by a race condition that is triggered after the 'realpath()' system call has checked a path. This may allow a local attacker to potentially rename a recently checked path and use a symlink to read from unauthorized parts of the file system.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
103489	Oracle Linux 6 : samba (ELSA-2017-2789)	Nessus	Oracle Linux Local Security Checks	2017/9/27	2024/10/22	high
101469	Virtuozzo 7 : ctdb / ctdb-tests / libsmbclient / etc (VZLSA-2017-1265)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2021/1/4	high
100344	Oracle Linux 7 : samba (ELSA-2017-1265)	Nessus	Oracle Linux Local Security Checks	2017/5/23	2024/11/1	high
220904	Linux Distros Unpatched Vulnerability : CVE-2017-2619	Nessus	Misc.	2025/3/4	2025/3/4	high
99685	Ubuntu 17.04 : samba vulnerability (USN-3267-1)	Nessus	Ubuntu Local Security Checks	2017/4/26	2023/1/12	high
97923	Debian DSA-3816-1 : samba - security update	Nessus	Debian Local Security Checks	2017/3/24	2021/1/11	high
99210	openSUSE Security Update : samba (openSUSE-2017-439)	Nessus	SuSE Local Security Checks	2017/4/6	2021/1/19	high
100329	CentOS 7 : samba (CESA-2017:1265)	Nessus	CentOS Local Security Checks	2017/5/23	2021/1/4	high
121068	Juniper Junos Space 18.4.x < 18.4R1 Multiple Vulnerabilities (JSA10917)	Nessus	Junos Local Security Checks	2019/1/10	2022/5/24	critical
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
700022	Samba 4.4.x < 4.4.12 / 4.5.x < 4.5.7 / 4.6.x < 4.6.1 Local File Disclosure	Nessus Network Monitor	Samba	2017/3/24	2019/3/6	low

检测

插件搜索

high

high

high

high

high

high

high

high

critical

critical

low