The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-bcd91bfcd3 advisory.

    Update to version 4.17.10, Security fixes for CVE-2022-2127, CVE-2023-3347, CVE-2023-34966, CVE-2023-34967     and CVE-2023-34968

    ----

    Fix netlogon LogonGetCapabilities level 2 error handling

    ----

    Update to version 4.17.9

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - Netlogon RPC Elevation of Privilege Vulnerability (CVE-2022-38023)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of samba installed on the remote host is prior to 4.18.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-216-02 advisory.

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not     enforced if an admin configured server signing = required or for SMB2 connections to Domain Controllers     where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-     the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and     server, affecting the integrity of the data. (CVE-2023-3347)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-316 advisory.

    When doing NTLM authentication, the client sends replies tocryptographic challenges back to the server.
    These replieshave variable length. Winbind did not properly bounds-checkthe lan manager response length,     which despite the lanmanager version no longer being used is still part of theprotocol.

    If the system is running Samba's ntlm_auth as authentication backendfor services like Squid (or a very     unusual configuration withFreeRADIUS), the vulnarebility is remotely exploitable

    If not so configured, or to exploit this vulnerability locally, theuser must have access to the privileged     winbindd UNIX domainsocket (a subdirectory with name 'winbindd_privileged' under statedirectory, as set     in the smb.conf).

    This access is normally only given so special system services likeSquid or FreeRADIUS, that use this     feature. (CVE-2022-2127)

    SMB2 packet signing not enforced

    NOTE: https://www.samba.org/samba/security/CVE-2023-3347.html (CVE-2023-3347)

    Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability

    NOTE: https://www.samba.org/samba/security/CVE-2023-34966.html (CVE-2023-34966)

    Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability

    NOTE: https://www.samba.org/samba/security/CVE-2023-34967.html (CVE-2023-34967)

    Spotlight server-side Share Path Disclosure

    NOTE: https://www.samba.org/samba/security/CVE-2023-34968.html (CVE-2023-34968)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6667 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190415)

    Security Fix(es):

    * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

    * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

    * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

    * samba: spotlight server-side share path disclosure (CVE-2023-34968)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5647 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5647-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 24, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : samba     CVE ID         : CVE-2022-2127 CVE-2022-3437 CVE-2023-4091 CVE-2023-34966                      CVE-2023-34967 CVE-2023-34968

    Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,     print, and login server for Unix, which might result in denial of service     or information disclosure.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 2:4.13.13+dfsg-1~deb11u6.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmYAipIACgkQEMKTtsN8     TjZGmg//cF9sreV4nxOrR4r7HU8pfvMNlIJVyVdAYKaoLVZjZim3Fgb7/7wMZbL5     fHDg1KJ9geMUoVJyIRkm+v3IxjTcdFPSl5OY8uRpFFQU7wtzvLvH+qc+50YKUwKv     Ur/mCQAffDO33RVHAQbWBKwdsSqyALT33zojGXM8srV+SGp/4KiNV0CL/uo38ACZ     lNRMpf0mXkbuaZbIQ7vlKytr9OnFXjKw8OjKM65EQ0vZ7durxiBxYzJ+wolGl2it     yIZEJF9X6X3oefZVPdgTEYYTntPWYsW0doQlrlRFuhNB+J3Lbxd2MobSVH5BRYQO     G15tZWd3v0NkeSmptOtTcd5HavBrY/S744J5WPvF4W6YCQaTo7LxZNa2TyMDRLL4     gtHPSZ3HXUAIFb08gB3dO75Gymm+PKdRIfXpt4ZMldQpgql730y7GDP3eultnrU3     N157iY3ejDNK439v7WTHI1oW6HjyyPT6OScp2uHOk7IJAVCM1UMPxRqtklNc5I6k     qnWUmDG0v4EeYeVVxh4kTwA2XxuNNABgts7DShgXj3EwEySSx43+YGLJKSmNOrwn     XZXr3XFZI0vbARNRczEFTay/ltZA2zrop97vYg5oQkUaXS9w7pBmwTVwK8MnctXH     ydMG+VSUMCSCai/A78wlVPPhCytB4lLaBUdST+uVhQ01HXyWdAo=     =0hpr
    -----END PGP SIGNATURE-----



Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
179375	Fedora 37 : samba (2023-bcd91bfcd3)	Nessus	Fedora Local Security Checks	2023/8/5	2024/11/14	medium
188756	EulerOS 2.0 SP10 : samba (EulerOS-SA-2023-3194)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
188872	EulerOS Virtualization 2.9.1 : samba (EulerOS-SA-2023-3093)	Nessus	Huawei Local Security Checks	2024/1/16	2025/1/6	high
179368	Slackware Linux 15.0 / current samba Multiple Vulnerabilities (SSA:2023-216-02)	Nessus	Slackware Local Security Checks	2023/8/4	2023/10/12	medium
180121	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-316)	Nessus	Amazon Linux Local Security Checks	2023/8/24	2024/12/11	medium
185142	RHEL 9 : samba (RHSA-2023:6667)	Nessus	Red Hat Local Security Checks	2023/11/7	2024/11/7	medium
188760	EulerOS 2.0 SP11 : samba (EulerOS-SA-2023-2852)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
192522	Debian dsa-5647 : ctdb - security update	Nessus	Debian Local Security Checks	2024/3/24	2025/1/24	medium

检测

插件搜索

medium

high

high

medium

medium

medium

medium

medium