The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1647 advisory.

  - samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

  - samba: Unprivileged user can crash winbind (CVE-2020-14323)

  - samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

远程 Scientific Linux 7 主机上安装的程序包受到 SLSA-2020: 5439-1 公告提及的多个漏洞的影响。

  - samba：Netlogon 权限提升漏洞 (Zerologon) (CVE-2020-1472)

  - samba：SMB1/2/3 ChangeNotify 中缺少句柄权限检查 (CVE-2020-14318)

  - samba：非特权用户可造成 winbind 崩溃 (CVE-2020-14323)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

远程主机上安装的测试产品版本低于测试版本。因此，如公告 ALAS2-2021-1585 所述，该主机受到多个漏洞的影响。

  - 在 samba 处理文件和目录权限的方式中发现一个缺陷。经过身份验证的用户可利用此缺陷，获取攻击者无法访问的某些文件和目录信息的访问权限。(CVE-2020-14318)

  - 在 4.11.15 之前、4.12.9 之前和 4.13.1 之前版本的 samba 的 Winbind 服务中发现一个空指针取消引用缺陷。本地用户可利用此缺陷来导致 winbind 服务崩溃，从而造成拒绝服务。(CVE-2020-14323)

  - 攻击者使用 Netlogon 远程协议 (MS-NRPC) 与域控制器建立有漏洞的 Netlogon 安全通道连接时，存在权限提升漏洞，即“Netlogon 权限提升漏洞”。(CVE-2020-1472)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

远程 CentOS Linux 7 主机上安装的程序包受到 RHSA-2020:5439 公告中提及的多个漏洞影响。

  - 在 samba 处理文件和目录权限的方式中发现一个缺陷。经过身份验证的用户可利用此缺陷，获取攻击者无法访问的某些文件和目录信息的访问权限。(CVE-2020-14318)

  - 在 4.11.15 之前、4.12.9 之前和 4.13.1 之前版本的 samba 的 Winbind 服务中发现一个空指针取消引用缺陷。本地用户可利用此缺陷来导致 winbind 服务崩溃，从而造成拒绝服务。(CVE-2020-14323)

  - 攻击者使用 Netlogon 远程协议 (MS-NRPC) 与域控制器建立有漏洞的 Netlogon 安全频道连接时，存在权限提升漏洞。成功利用该漏洞的攻击者可在网络设备上运行特别构建的应用程序。为利用此漏洞，未经身份验证的攻击者需要使用 MS-NRPC 连接域控制器，以获取域管理员访问权限。Microsoft 正在通过分为两部分的分阶段实施来解决此漏洞。这些更新通过修改 Netlogon 处理 Netlogon 安全通道使用情况的方式来修复漏洞。有关如何管理此漏洞所需的变更的指南和有关分阶段推出的更多信息，请参阅如何管理与 CVE-2020-1472 相关的 Netlogon 安全通道连接中的变更（2020 年 9 月 28 日更新）。2021 年 第 1 季度提供 Windows 更新的第二阶段时，客户将收到此安全漏洞修订版的通知。如果您希望在发布这些更新时收到通知，建议您注册安全通知邮件程序，以便收到此公告的内容变更警报。
    请参阅 Microsoft 技术安全通知。 (CVE-2020-1472)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2021: 1647 公告中提及的多个漏洞影响。

  - samba：SMB1/2/3 ChangeNotify 中缺少句柄权限检查 (CVE-2020-14318)

  - samba：非特权用户可造成 winbind 崩溃 (CVE-2020-14323)

  - samba：Netlogon 权限提升漏洞 (Zerologon) (CVE-2020-1472)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

运行 CORE 5.05 / MAIN 5.05 版本的远程 NewStart CGSL 主机上安装的 samba 程序包受到多个漏洞的影响：

  - 所有 samba 4.9.18 之前的 4.9.x、4.10.12 之前的 4.10.x 和 4.11.5 之前的 4.11.x 中都存在一个问题，如果以日志级别 = 3（或更高值）进行设置，则在字符转换失败后，将打印从客户端获取的字符串。可在 NTLMSSP 身份验证交换期间提供此类字符串。
    特别是在 Samba AD DC 中，这可能造成长期限进程（如 RPC 服务器）终止。（在文件服务器的情况下，smbd 最可能成为目标，但其以每个客户端一个进程的方式进程按客户端运行，因此发生崩溃不会造成危害）。(CVE-2019-14907)

  - 在 samba 处理文件和目录权限的方式中发现一个缺陷。经过身份验证的用户可利用此缺陷，获取攻击者无法访问的某些文件和目录信息的访问权限。(CVE-2020-14318)

  - 在 4.11.15 之前、4.12.9 之前和 4.13.1 之前版本的 samba 的 Winbind 服务中发现一个空指针取消引用缺陷。本地用户可利用此缺陷来导致 winbind 服务崩溃，从而造成拒绝服务。(CVE-2020-14323)

  - 攻击者使用 Netlogon 远程协议 (MS-NRPC) 与域控制器建立有漏洞的 Netlogon 安全通道连接时，存在权限提升漏洞，即“Netlogon 权限提升漏洞”。(CVE-2020-1472)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - As Samba internally opens an underlying file system     handle on a directory when a client requests an open,     even for FILE_READ_ATTRIBUTES then if the underlying     file system permissions don&#39t allow &quotr&quot     (read) access for the connected user, then the handle     open request will be denied.&quot(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Samba, all versions starting samba     4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2,     in the way it handles a user password change or a new     password for a samba user. The Samba Active Directory     Domain Controller can be configured to use a custom     script to check for password complexity. This     configuration can fail to verify password complexity     when non-ASCII characters are used in the password,     which could lead to weak passwords being set for samba     users, making it vulnerable to dictionary     attacks.(CVE-2019-14833)

  - A flaw was found in samba 4.0.0 before samba 4.9.15 and     samba 4.10.x before 4.10.10. An attacker can crash AD     DC LDAP server via dirsync resulting in denial of     service. Privilege escalation is not possible with this     issue.(CVE-2019-14847)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - Heimdal before 7.4 allows remote attackers to     impersonate services with Orpheus' Lyre attacks because     it obtains service-principal names in a way that     violates the Kerberos 5 protocol specification. In
    _krb5_extract_ticket() the KDC-REP service name must be     obtained from the encrypted version stored in     'enc_part' instead of the unencrypted version stored in     'ticket'. Use of the unencrypted version provides an     opportunity for successful server impersonation and     other attacks. NOTE: this CVE is only for Heimdal and     other products that embed Heimdal code it does not     apply to other instances in which this part of the     Kerberos 5 protocol specification is     violated.(CVE-2017-11103)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

  - CVE-2020-14383: An authenticated user can crash the     DCE/RPC DNS with easily crafted records (bsc#1177613).

  - CVE-2020-14323: Unprivileged user can crash winbind     (bsc#1173994).

  - CVE-2020-14318: Missing permissions check in SMB1/2/3     ChangeNotify (bsc#1173902).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in the way samba handled file and     directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory     information which otherwise would be unavailable to the     attacker.(CVE-2020-14318)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in samba's DNS server. An     authenticated user could use this flaw to the RPC     server to crash. This RPC server, which also serves     protocols other than dnsserver, will be restarted after     a short delay, but it is easy for an authenticated non     administrative attacker to crash it again as soon as it     returns. The Samba DNS server itself will continue to     operate, but many RPC services will     not.(CVE-2020-14383)

  - As Samba internally opens an underlying file system     handle on a directory when a client requests an open,     even for FILE_READ_ATTRIBUTES then if the underlying     file system permissions don&#39t allow &quotr&quot     (read) access for the connected user, then the handle     open request will be denied.&quot(CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's     Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this     flaw to crash the winbind service causing denial of     service.(CVE-2020-14323)

  - A flaw was found in the AD DC NBT server in all Samba     versions before 4.10.17, before 4.11.11 and before     4.12.4. A samba user could send an empty UDP packet to     cause the samba server to crash.(CVE-2020-14303)

  - A flaw was found in all Samba versions before 4.10.17,     before 4.11.11 and before 4.12.4 in the way it     processed NetBios over TCP/IP. This flaw allows a     remote attacker could to cause the Samba server to     consume excessive CPU use, resulting in a denial of     service. This highest threat from this vulnerability is     to system availability.(CVE-2020-10745)

  - A use-after-free flaw was found in all samba LDAP     server versions before 4.10.17, before 4.11.11, before     4.12.4 used in a AC DC configuration. A Samba LDAP user     could use this flaw to crash samba.(CVE-2020-10760)

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'.(CVE-2020-1472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3723 advisory.

  - samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

  - samba: Unprivileged user can crash winbind (CVE-2020-14323)

  - samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

  - samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process     token (CVE-2021-20254)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.10.16-13. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1649 advisory.

    A flaw was found in the way Samba handled file and directory permissions. This flaw allows an     authenticated user to gain access to certain file and directory information, which otherwise would be     unavailable. The highest threat from this vulnerability is to confidentiality. (CVE-2020-14318)

    A null pointer dereference flaw was found in Samba's winbind service. This flaw allows a local user to     crash the winbind service, causing a denial of service. The highest threat from this vulnerability is to     system availability. (CVE-2020-14323)

    A flaw was found in the Microsoft Windows Netlogon Remote Protocol (MS-NRPC), where it reuses a known,     static, zero-value initialization vector (IV) in AES-CFB8 mode. This flaw allows an unauthenticated     attacker to impersonate a domain-joined computer, including a domain controller, and possibly obtain     domain administratorprivileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2020-1472)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1647 advisory.

  - A flaw was found in the way samba handled file and directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory information which otherwise would be unavailable to     the attacker. (CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of     service. (CVE-2020-14323)

  - An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'. (CVE-2020-1472)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
149752	CentOS 8 : samba (CESA-2021:1647)	Nessus	CentOS Local Security Checks	2021/5/19	2024/11/28	medium
144296	Scientific Linux 安全更新：SL7.x i686/x86_64 上的 samba (2020:5439)	Nessus	Scientific Linux Local Security Checks	2020/12/15	2024/11/29	medium
144800	Amazon Linux 2：ctdb (ALAS-2021-1585)	Nessus	Amazon Linux Local Security Checks	2021/1/7	2024/12/11	medium
144973	CentOS 7：samba (RHSA-2020:5439)	Nessus	CentOS Local Security Checks	2021/1/14	2024/11/29	medium
149679	RHEL 8：samba (RHSA-2021: 1647)	Nessus	Red Hat Local Security Checks	2021/5/19	2024/11/28	medium
154485	NewStart CGSL CORE 5.05 / MAIN 5.05 : samba 多个漏洞 (NS-SA-2021-0167)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2024/11/28	medium
143416	EulerOS 2.0 SP9 : samba (EulerOS-SA-2020-2491)	Nessus	Huawei Local Security Checks	2020/12/1	2021/1/6	medium
144176	EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-2533)	Nessus	Huawei Local Security Checks	2020/12/14	2021/1/6	medium
146748	EulerOS 2.0 SP2 : samba (EulerOS-SA-2021-1357)	Nessus	Huawei Local Security Checks	2021/2/22	2024/1/19	high
142540	openSUSE Security Update : samba (openSUSE-2020-1811)	Nessus	SuSE Local Security Checks	2020/11/6	2020/12/8	medium
145189	EulerOS 2.0 SP3 : samba (EulerOS-SA-2021-1118)	Nessus	Huawei Local Security Checks	2021/1/20	2024/11/29	medium
147047	EulerOS Virtualization for ARM 64 3.0.6.0 : samba (EulerOS-SA-2021-1533)	Nessus	Huawei Local Security Checks	2021/3/4	2024/11/29	medium
147497	EulerOS Virtualization 2.9.1 : samba (EulerOS-SA-2021-1625)	Nessus	Huawei Local Security Checks	2021/3/10	2024/11/29	medium
153886	RHEL 7 : samba (RHSA-2021:3723)	Nessus	Red Hat Local Security Checks	2021/10/5	2024/3/5	medium
169521	Amazon Linux 2 : samba (ALAS-2021-1649)	Nessus	Amazon Linux Local Security Checks	2023/1/4	2024/12/11	medium
184966	Rocky Linux 8 : samba (RLSA-2021:1647)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2024/11/26	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium