The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the samba-4.18.5-100.el9 build changelog.

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not     enforced if an admin configured server signing = required or for SMB2 connections to Domain Controllers     where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-     the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and     server, affecting the integrity of the data. (CVE-2023-3347)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0313 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-2127:
      An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash.

      CVE-2023-34966:
      An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition.

      CVE-2023-34967:
      A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves.

      CVE-2023-34968:
      A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses     the server-side absolute path of shares, files, and directories in the results for search queries. This     flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is     part of the disclosed path.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0343 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 8.8. It addresses 7 CVEs:
    CVE-2022-2127, CVE-2023-34966, CVE-2023-42669, CVE-2023-34968, CVE-2023-3961, and 2 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7219:13 advisory.

    samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)         samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)         samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)         samba: spotlight server-side share path disclosure (CVE-2023-34968)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2023_7139 advisory.

    * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

    * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

    * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

    * samba: spotlight server-side share path disclosure (CVE-2023-34968)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Samba running on the remote host is 4.16.x prior to 4.16.10, 4.17.x prior to 4.17.9, or 4.18.x prior to 4.18.4.  It is, therefore, potentially affected by multiple vulnerabilities, including the following:

  - An out-of-bounds read error was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When     performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies     have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM     authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in     a crash. (CVE-2022-2127) 

  - An infinite loop condition was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc     RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the     network packet that contains the count of elements in an array-like structure. By passing 0 as the count value,     the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a     malformed RPC request, triggering an infinite loop, resulting in a denial of service condition. (CVE-2023-34966)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an     admin configured 'server signing = required' or for SMB2 connections to Domain Controllers where SMB2 packet     signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by     intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the     integrity of the data. (CVE-2023-3347)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 441e1e1a-27a5-11ee-a156-080027f5fec9 advisory.

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not     enforced if an admin configured server signing = required or for SMB2 connections to Domain Controllers     where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-     the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and     server, affecting the integrity of the data. (CVE-2023-3347)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7139 advisory.

    - resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968
    - resolves: rhbz#2154370 - Fix CVE-2022-38023
    - resolves: rhbz#2126174 - Fix CVE-2022-1615
    - resolves: rhbz#2108331 - Fix CVE-2022-32742
    - resolves: rhbz#2046127 - Fix CVE-2021-44141
    - resolves: rhbz#2046153 - Fix CVE-2021-44142
    - resolves: rhbz#2039153 - Fix CVE-2021-20316
    - resolves: rhbz#2039157 - Fix CVE-2021-43566
    - related: rbhz#2019674 - Fix CVE-2020-25717
    - related: rbhz#2019674 - Fix CVE-2020-25717
    - resolves: rhbz#2019662 - Fix CVE-2016-2124
    - resolves: rhbz#2019668 - Fix CVE-2021-23192
    - resolves: rbhz#2019674 - Fix CVE-2020-25717
    - resolves: rhbz#1949445 - Fix CVE-2021-20254
    - resolves: #1891688 - Fix CVE-2020-14323
    - resolves: #1892633 - Fix CVE-2020-14318
    - resolves: #1892639 - Fix CVE-2020-14383
    - resolves: #1879835 - Fix CVE-2020-1472
    - resolves: #1791209 - Fix CVE-2019-14907
    - resolves: #1764469 - Fix CVE-2019-10218
    - resolves: #1746241 - Fix CVE-2019-10197
    - resolves: #1696525 - Fix CVE-2019-3880
    - resolves: #1554753 - Fix CVE-2018-1050
    - resolves: #1617912 - Fix CVE-2018-10858
    - resolves: #1617913 - Fix CVE-2018-10918
    - resolves: #1617914 - Fix CVE-2018-10919
    - resolves: #1617915 - Fix CVE-2018-1139
    - resolves: #1554754, #1554756 - Security fixes for CVE-2018-1050 CVE-2018-1057
    - resolves: #1515692 - Security fix for CVE-2017-14746 and CVE-2017-15275
    - resolves: #1493441 - Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163
    - resolves: #1455050 - Security fix for CVE-2017-7494
    - related: #1435156 - Security fix for CVE-2017-2619
    - resolves: #1435156 - Security fix for CVE-2017-2619
    - resolves: #1405984 - CVE-2016-2123,CVE-2016-2125 and CVE-2016-2126
    - resolves: #1353504 - CVE-2016-2119
    - resolves: #1326453 - CVE-2015-5370
    - resolves: #1326453 - CVE-2016-2110
    - resolves: #1326453 - CVE-2016-2111
    - resolves: #1326453 - CVE-2016-2112
    - resolves: #1326453 - CVE-2016-2113
    - resolves: #1326453 - CVE-2016-2114
    - resolves: #1326453 - CVE-2016-2115
    - resolves: #1326453 - CVE-2016-2118
    - resolves: #1315942 - CVE-2015-7560 Incorrect ACL get/set allowed on symlink path
    - CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
    - CVE-2015-5252 Insufficient symlink verification in smbd
    - CVE-2015-5296 Samba client requesting encryption vulnerable to                     downgrade attack
    - CVE-2015-5299 Missing access control check in shadow copy code
    - CVE-2015-7540 DoS to AD-DC due to insufficient checking of asn1                     memory allocation
    - resolves: #1126015 - Fix CVE-2014-3560
    - resolves: #1112251 - Fix CVE-2014-0244 and CVE-2014-3493.
    - resolves: #1102528 - CVE-2014-0178.
    - Fix CVE-2013-4496 and CVE-2013-6442.
    - resolves: #1039454 - CVE-2013-4408.
    - resolves: #1039500 - CVE-2012-6150.
    - resolves: #1024544 - Fix CVE-2013-4475.
    - Fixes CVE-2013-0213.
    - Fixes CVE-2013-0214.
    - Fixes CVE-2013-0172.
    - Security Release, fixes CVE-2012-2111
    - Fixes CVE-2012-1182
    - Fixes CVE-2012-0817
    - Fixes CVE-2010-0728
    - Security Release, fixes CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906
    - Security Release, fixes CVE-2008-4314
    - Security fix for CVE-2008-3789
    - Add fix for CVE-2008-1105
    - includes security fixes for CVE-2007-2444,CVE-2007-2446,CVE-2007-2447

    * Mon Apr 30 2007 Gunther Deschner <gdeschner@redhat.com>

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of samba installed on the remote host is prior to 4.18.5. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-216-02 advisory.

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not     enforced if an admin configured server signing = required or for SMB2 connections to Domain Controllers     where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-     the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and     server, affecting the integrity of the data. (CVE-2023-3347)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6667 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190415)

    Security Fix(es):

    * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

    * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

    * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

    * samba: spotlight server-side share path disclosure (CVE-2023-34968)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5647 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5647-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 24, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : samba     CVE ID         : CVE-2022-2127 CVE-2022-3437 CVE-2023-4091 CVE-2023-34966                      CVE-2023-34967 CVE-2023-34968

    Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,     print, and login server for Unix, which might result in denial of service     or information disclosure.

    For the oldstable distribution (bullseye), these problems have been fixed     in version 2:4.13.13+dfsg-1~deb11u6.

    We recommend that you upgrade your samba packages.

    For the detailed security status of samba please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/samba

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmYAipIACgkQEMKTtsN8     TjZGmg//cF9sreV4nxOrR4r7HU8pfvMNlIJVyVdAYKaoLVZjZim3Fgb7/7wMZbL5     fHDg1KJ9geMUoVJyIRkm+v3IxjTcdFPSl5OY8uRpFFQU7wtzvLvH+qc+50YKUwKv     Ur/mCQAffDO33RVHAQbWBKwdsSqyALT33zojGXM8srV+SGp/4KiNV0CL/uo38ACZ     lNRMpf0mXkbuaZbIQ7vlKytr9OnFXjKw8OjKM65EQ0vZ7durxiBxYzJ+wolGl2it     yIZEJF9X6X3oefZVPdgTEYYTntPWYsW0doQlrlRFuhNB+J3Lbxd2MobSVH5BRYQO     G15tZWd3v0NkeSmptOtTcd5HavBrY/S744J5WPvF4W6YCQaTo7LxZNa2TyMDRLL4     gtHPSZ3HXUAIFb08gB3dO75Gymm+PKdRIfXpt4ZMldQpgql730y7GDP3eultnrU3     N157iY3ejDNK439v7WTHI1oW6HjyyPT6OScp2uHOk7IJAVCM1UMPxRqtklNc5I6k     qnWUmDG0v4EeYeVVxh4kTwA2XxuNNABgts7DShgXj3EwEySSx43+YGLJKSmNOrwn     XZXr3XFZI0vbARNRczEFTay/ltZA2zrop97vYg5oQkUaXS9w7pBmwTVwK8MnctXH     ydMG+VSUMCSCai/A78wlVPPhCytB4lLaBUdST+uVhQ01HXyWdAo=     =0hpr
    -----END PGP SIGNATURE-----



Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0027 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 8.6. It addresses 74 CVEs:
    CVE-2008-4314, CVE-2018-1050, CVE-2015-7560, CVE-2013-4475, CVE-2019-14907, and 69 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
191226	CentOS 9 : samba-4.18.5-100.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
276207	TencentOS Server 3: samba (TSSA-2023:0313)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
355005	Rocky Linux 8.8 [CIQ] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (ciqsa-2026_0343)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
292933	MiracleLinux 8 : samba-4.18.6-1.el8 (AXSA:2023-7219:13)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
355672	Rocky Linux 8 [CIQ] Security Update: evolution-mapi / evolution-mapi-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_7139)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
179166	Samba 4.16.x < 4.16.10 / 4.17.x < 4.17.9 / 4.18.x < 4.18.4 Multiple Vulnerabilities	Nessus	Misc.	2023/8/1	2023/10/12	medium
179385	FreeBSD : samba -- multiple vulnerabilities (441e1e1a-27a5-11ee-a156-080027f5fec9)	Nessus	FreeBSD Local Security Checks	2023/8/5	2023/10/12	medium
186100	Oracle Linux 8 : samba (ELSA-2023-7139)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	medium
188873	EulerOS 2.0 SP11 : samba (EulerOS-SA-2023-2869)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
179368	Slackware Linux 15.0 / current samba Multiple Vulnerabilities (SSA:2023-216-02)	Nessus	Slackware Local Security Checks	2023/8/4	2023/10/12	medium
185142	RHEL 9 : samba (RHSA-2023:6667)	Nessus	Red Hat Local Security Checks	2023/11/7	2024/11/7	medium
188760	EulerOS 2.0 SP11 : samba (EulerOS-SA-2023-2852)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
188911	EulerOS Virtualization 2.11.1 : samba (EulerOS-SA-2023-3062)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
192522	Debian dsa-5647 : ctdb - security update	Nessus	Debian Local Security Checks	2024/3/24	2026/1/21	medium
358859	Rocky Linux 8.6 [CIQ] Security Update: ctdb / libsmbclient / libsmbclient-devel / libwbclient / etc Multiple Vulnerabilities (ciqsa-2026_0027)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

检测

插件搜索

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical