The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0019-1 advisory.

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue,     where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be     opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by     forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD     DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the     not-delegated flag set. (CVE-2019-14870)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

  - Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a     preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept. (CVE-2021-44758)

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

  - Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a     denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via     PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users     should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue. (CVE-2022-41916)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

  - Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the     ASN.1 codec used by the Key Distribution Center (KDC). (CVE-2022-44640)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has 'a similar bug.'     (CVE-2022-42898)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of samba installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3437 advisory.

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0160-1 advisory.

    - CVE-2021-20251: Fixed an issue where the bad password count would       not be properly incremented, which could allow attackers to brute       force a user's password (bsc#1206546).

    - Updated to version 4.15.13:
      - CVE-2022-37966: Fixed an issue where a weak cipher would be         selected to encrypt session keys, which could lead to privilege         escalation (bsc#1205385).
      - CVE-2022-37967: Fixed a potential privilege escalation issue via         constrained delegation due to weak a cryptographic algorithm         being selected (bsc#1205386).
      - CVE-2022-38023: Disabled weak ciphers by default in the Netlogon         Secure channel (bsc#1206504).

    - Updated to version 4.15.12:
      - CVE-2022-42898: Fixed several buffer overflow vulnerabilities on       32-bit systems (bsc#1205126).

    - Updated to version 4.15.11:
      - CVE-2022-3437: Fixed a buffer overflow in Heimdal unwrap_des3()       (bsc#1204254).

    - Updated to version 4.15.10:
      - Fixed a potential crash due to a concurrency issue (bsc#1200102).

    - Updated to version 4.15.9:
      - CVE-2022-32742: Fixed an information leak that could be triggered         via SMB1 (bsc#1201496).
      - CVE-2022-32746: Fixed a memory corruption issue in database         audit logging (bsc#1201490).
      - CVE-2022-2031: Fixed AD restrictions bypass associated with         changing passwords (bsc#1201495).
      - CVE-2022-32745: Fixed a remote server crash that could be         triggered with certain LDAP requests (bsc#1201492).
      - CVE-2022-32744: Fixed an issue where AD users could have forged         password change requests on behalf of other users (bsc#1201493).

    Other fixes:

    - Fixed a problem when using bind as samba-ad-dc backend related to       the named service (bsc#1201689).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-2c77cee4b5 advisory.

    Fixes:

    * Delay service starts until after network is online (rhbz#2005501)
    * Restart services on package update (will apply when updating from this release)


    ----

    This release fixes the following Security Vulnerabilities:

    * CVE-2022-42898 PAC parse integer overflows
    * CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour
    * CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array
    * CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors
    * CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ
    * CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec

    Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring     System (CVSS) v3.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0020-1 advisory.

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue,     where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be     opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by     forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD     DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the     not-delegated flag set. (CVE-2019-14870)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

  - Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a     preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept. (CVE-2021-44758)

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

  - Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a     denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via     PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users     should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue. (CVE-2022-41916)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

  - Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the     ASN.1 codec used by the Key Distribution Center (KDC). (CVE-2022-44640)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-032 advisory.

    2024-02-15: CVE-2016-2124 was added to this advisory.

    2024-02-15: CVE-2021-44141 was added to this advisory.

    2024-02-15: CVE-2021-20316 was added to this advisory.

    2024-02-15: CVE-2020-17049 was added to this advisory.

    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

    It was found that the Kerberos Key Distribution Center (KDC) delegation feature, Service for User (S4U),     did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service     principal allowed to delegate could use this flaw to impersonate a non-forwardable user. (CVE-2020-17049)

    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share.

    A fix for CVE-2021-20316 will not be provided for Amazon Linux 1 and Amazon Linux 2. You can mitigate this     issue by disabling SMBv1.To do so, add server min protocol = SMB2 to the [global] section of     /etc/samba/smb.conf (CVE-2021-20316)

    All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to     allow a directory to be created in an area of the server file system not exported under the share     definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack     to succeed. (CVE-2021-43566)

    All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

    A fix for CVE-2021-44141 for will not be provided for Amazon Linux 1 and Amazon Linux 2. You can mitigate     this issue by disabling SMBv1.To do so, add server min protocol = SMB2 to the [global] section of     /etc/samba/smb.conf (CVE-2021-44141)

    Samba AD users with permission to write to an account can impersonate arbitrary services (CVE-2022-0336)

    In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. (CVE-2022-1615)

    A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer). (CVE-2022-32742)

    Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit     unprivileged users to write it. (CVE-2022-32743)

    A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl. (CVE-2022-32746)

    A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

    Samba 4.17 introduced following symlinks in user space with the intent to properly check symlink targets     to stay within the share that was configured by the administrator. The check does not properly cover a     corner case, so that a user can create a symbolic link that will make smbd escape the configured share     path. (CVE-2022-3592)

    Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability. (CVE-2022-37966)

    Windows Kerberos Elevation of Privilege Vulnerability. (CVE-2022-37967)

    Netlogon RPC Elevation of Privilege Vulnerability. (CVE-2022-38023)

    Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets (CVE-2022-45141)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3792 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3792-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Santiago Ruano Rincn     April 22, 2024                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : samba     Version        : 2:4.9.5+dfsg-5+deb10u5     CVE ID         : CVE-2020-14318 CVE-2020-14323 CVE-2020-14383 CVE-2022-2127                      CVE-2022-3437 CVE-2022-32742 CVE-2023-4091

    Several vulnerabilities were discovered in Samba, SMB/CIFS file,     print, and login server for Unix

    CVE-2020-14318

        Missing handle permissions check in ChangeNotify

    CVE-2020-14323

        Unprivileged user can crash winbind via invalid lookupsids DoS

    CVE-2020-14383

        DNS server crash via invalid records resulting from uninitialized         variables

    CVE-2022-2127

        Out-of-bounds read in winbind AUTH_CRAP

    CVE-2022-3437

        Heimdal des/des3 heap-based buffer overflow

    CVE-2022-32742

        Server memory information leak via SMB1

    CVE-2023-4091

        Client can truncate files even with read-only permissions

    For Debian 10 buster, these problems have been fixed in version     2:4.9.5+dfsg-5+deb10u5.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5647 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5647-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 24, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : samba     CVE ID         : CVE-2022-2127 CVE-2022-3437 CVE-2023-4091 CVE-2023-34966                      CVE-2023-34967 CVE-2023-34968

    Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,     print, and login server for Unix, which might result in denial of service     or information disclosure.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 2:4.13.13+dfsg-1~deb11u6.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmYAipIACgkQEMKTtsN8     TjZGmg//cF9sreV4nxOrR4r7HU8pfvMNlIJVyVdAYKaoLVZjZim3Fgb7/7wMZbL5     fHDg1KJ9geMUoVJyIRkm+v3IxjTcdFPSl5OY8uRpFFQU7wtzvLvH+qc+50YKUwKv     Ur/mCQAffDO33RVHAQbWBKwdsSqyALT33zojGXM8srV+SGp/4KiNV0CL/uo38ACZ     lNRMpf0mXkbuaZbIQ7vlKytr9OnFXjKw8OjKM65EQ0vZ7durxiBxYzJ+wolGl2it     yIZEJF9X6X3oefZVPdgTEYYTntPWYsW0doQlrlRFuhNB+J3Lbxd2MobSVH5BRYQO     G15tZWd3v0NkeSmptOtTcd5HavBrY/S744J5WPvF4W6YCQaTo7LxZNa2TyMDRLL4     gtHPSZ3HXUAIFb08gB3dO75Gymm+PKdRIfXpt4ZMldQpgql730y7GDP3eultnrU3     N157iY3ejDNK439v7WTHI1oW6HjyyPT6OScp2uHOk7IJAVCM1UMPxRqtklNc5I6k     qnWUmDG0v4EeYeVVxh4kTwA2XxuNNABgts7DShgXj3EwEySSx43+YGLJKSmNOrwn     XZXr3XFZI0vbARNRczEFTay/ltZA2zrop97vYg5oQkUaXS9w7pBmwTVwK8MnctXH     ydMG+VSUMCSCai/A78wlVPPhCytB4lLaBUdST+uVhQ01HXyWdAo=     =0hpr
    -----END PGP SIGNATURE-----



Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
170095	openSUSE 15 Security Update : libheimdal (openSUSE-SU-2023:0019-1)	Nessus	SuSE Local Security Checks	2023/1/17	2023/9/7	critical
171326	EulerOS 2.0 SP10 : samba (EulerOS-SA-2023-1371)	Nessus	Huawei Local Security Checks	2023/2/10	2023/9/28	high
169553	EulerOS 2.0 SP11 : samba (EulerOS-SA-2023-1046)	Nessus	Huawei Local Security Checks	2023/1/5	2024/1/16	medium
295605	Azure Linux 3.0 Security Update: samba (CVE-2022-3437)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium
170707	SUSE SLED15: ctdb / ctdb-pcp-pmda / libsamba-policy-devel / etc (SUSE-SU-2023:0160-1)	Nessus	SuSE Local Security Checks	2023/1/27	2026/6/26	high
211098	Fedora 37 : heimdal (2022-2c77cee4b5)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	critical
170098	openSUSE 15 Security Update : libheimdal (openSUSE-SU-2023:0020-1)	Nessus	SuSE Local Security Checks	2023/1/17	2023/9/7	critical
173148	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-032)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2026/1/9	critical
193744	Debian dla-3792 : ctdb - security update	Nessus	Debian Local Security Checks	2024/4/23	2026/1/21	medium
192522	Debian dsa-5647 : ctdb - security update	Nessus	Debian Local Security Checks	2024/3/24	2026/1/21	medium

检测

插件搜索

critical

high

medium

medium

high

critical

critical

critical

medium

medium