The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1860 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Null pointer indirection in printer server process (CVE-2018-1050)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Samba project for reporting this issue.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes     and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1883 advisory.

  - samba: NULL pointer dereference in printer server process (CVE-2018-1050)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1860 advisory.

    - resolves: #1553018 - Fix CVE-2018-1050
    - resolves: #1509455 - Fix regression of CVE-2017-2619
    - resolves: #1491211 - CVE-2017-2619 CVE-2017-12150 CVE-2017-12163
    - resolves: #1450783 - Fix CVE-2017-7494
    - resolves: #1405356 - CVE-2016-2125 CVE-2016-2126
    - resolves: #1322687 - Fix CVE-2015-5370
    - resolves: #1322687 - Fix CVE-2016-2110
    - resolves: #1322687 - Fix CVE-2016-2111
    - resolves: #1322687 - Fix CVE-2016-2112
    - resolves: #1322687 - Fix CVE-2016-2115
    - resolves: #1322687 - Fix CVE-2016-2118 (Known as Badlock)
    - resolves: #1314671 - Fix CVE-2015-7560
    - resolves: #1290707 - CVE-2015-5299
    - related: #1290707 - CVE-2015-5296
    - related: #1290707 - CVE-2015-5252
    - related: #1290707 - CVE-2015-5330
    - related: #1191339 - Update patchset for CVE-2015-0240.
    - resolves: #1191339 - CVE-2015-0240: RCE in netlogon.
    - resolves: #1105500 - CVE-2014-0244: DoS in nmbd.
    - resolves: #1108841 - CVE-2014-3493: DoS in smbd with unicode path names.
    - resolves: #1073356 - Fix CVE-2013-4496, CVE-2012-6150 and CVE-2013-6442.
    - resolves: #1018038 - Fix CVE-2013-4408.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - samba: NULL pointer indirection in printer server     process (CVE-2018-1050)

According to its self-reported version number, the remote Junos Space version is 18.4.x prior to 18.4R1. It is, therefore, affected by multiple vulnerabilities : 

  - An integer overflow issue exists in procps-ng. This is     related to CVE-2018-1124. (CVE-2018-1126)

  - A directory traversal issue exits in reposync, a part     of yum-utils.tory configuration files. If an attacker     controls a repository, they may be able to copy files     outside of the destination directory on the targeted     system via path traversal. (CVE-2018-10897)

  - An integer overflow flaw was found in the Linux     kernel's create_elf_tables() function. An unprivileged     local user with access to SUID binary could use this     flaw to escalate their privileges on the system.
    (CVE-2018-14634)

Additionally, Junos Space is affected by several other vulnerabilities exist as noted in the vendor advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues :

CVE-2018-1050

It was discovered that Samba is prone to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Thanks for Jeremy Allison for the patch.

https://www.samba.org/samba/security/CVE-2018-1050.html

For Debian 7 'Wheezy', these problems have been fixed in version 3.6.6-6+deb7u16.

We recommend that you upgrade your samba packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for samba is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* samba: NULL pointer indirection in printer server process (CVE-2018-1050)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Samba project for reporting this issue.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2613 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Weak authentication protocol regression (CVE-2018-1139)

    * samba: Insufficient input validation in libsmbclient (CVE-2018-10858)

    * samba: Null pointer indirection in printer server process (CVE-2018-1050)

    Red Hat would like to thank the Samba project for reporting CVE-2018-1139 and CVE-2018-1050. Upstream     acknowledges Vivek Das (Red Hat) as the original reporter of CVE-2018-1139.

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previously, sharing a subdirectory of a Gluster volume failed with an I/O error when the shadow_copy2     vfs object was specified. This occurred because Gluster volumes are remote file systems, and shadow_copy2     only detected share paths in the local file system. This update forces the value of shadow:mountpath to     '/', skipping the code related to mount point detection, and preventing this problem. However, this fix     requires that the glusterfs vfs object is listed after the shadow_copy2 vfs object in the smb.conf file.
    (BZ#1379444)

    * As of Red Hat Gluster Storage 3.4, the libldb package is no longer shipped as an independent package in     the Red Hat Gluster Storage Samba channel. The capabilities of the libldb package are now provided by a     combination of the samba-client and samba-client-libs packages. In addition, the sub-packages previously     provided by libldb are now provided by the samba-client and samba-client-libs packages. The samba-client     sub-package provides ldb-tools, and the samba-client-libs sub-package provides pyldb. (BZ#1592794)

    Enhancement(s):

    * Red Hat Gluster Storage volumes exported using SMB can now be mounted on macOS clients using Finder.
    Configuration instructions are provided as part of the Red Hat Gluster Storage 3.4 documentation.
    (BZ#1446125)

    Red Hat strongly recommends upgrading to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for samba fixes the following issues :

The following security issues were fixed :

CVE-2018-1050: Fixed denial of service vulnerability when SPOOLSS is run externally (bsc#1081741).

CVE-2018-10858: smbc_urlencode helper function is a subject to buffer overflow (bsc#1103411)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash.(CVE-2018-1050)

A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client.(CVE-2018-10858)

A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.(CVE-2018-1139)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - samba: Insufficient input validation in libsmbclient     (CVE-2018-10858)

  - samba: NULL pointer dereference in printer server     process (CVE-2018-1050)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various vulnerabilities were discovered in Samba, SMB/CIFS file, print, and login server/client for Unix

CVE-2017-9461

smbd in Samba had a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

CVE-2018-1050

Samba was vulnerable to a denial of service attack when the RPC spoolss service was configured to be run as an external daemon.
Missing input sanitization checks on some of the input parameters to spoolss RPC calls could have caused the print spooler service to crash.

CVE-2018-1057

On a Samba 4 AD DC the LDAP server of Samba incorrectly validated permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Thanks to the Ubuntu security team for having backported the rather invasive changeset to Samba in Ubuntu 14.04 (which we could use to patch Samba in Debian jessie LTS).

CVE-2019-3880

A flaw was found in the way Samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could have used this flaw to create a new registry hive file anywhere they had unix permissions which could have lead to creation of a new file in the Samba share.

For Debian 8 'Jessie', these problems have been fixed in version 2:4.2.14+dfsg-0+deb8u12.

We recommend that you upgrade your samba packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A null pointer dereference flaw was found in Samba RPC     external printer service. An attacker could use this     flaw to cause the printer spooler service to     crash.(CVE-2018-1050)

  - A heap-buffer overflow was found in the way samba     clients processed extra long filename in a directory     listing. A malicious samba server could use this flaw     to cause arbitrary code execution on a samba client.
    (CVE-2018-10858)

  - A use-after-free flaw was found in the way samba     servers handled certain SMB1 requests. An     unauthenticated attacker could send specially-crafted     SMB1 requests to cause the server to crash or execute     arbitrary code.(CVE-2017-14746)

  - A memory disclosure flaw was found in samba. An     attacker could retrieve parts of server memory, which     could contain potentially sensitive data, by sending     specially-crafted requests to the samba     server.(CVE-2017-15275)

  - It was found that samba did not enforce 'SMB signing'     when certain configuration options were enabled. A     remote attacker could launch a man-in-the-middle attack     and retrieve information in plain-text.(CVE-2017-12150)

  - A flaw was found in the way samba client used     encryption with the max protocol set as SMB3. The     connection could lose the requirement for signing and     encrypting to any DFS redirects, allowing an attacker     to read or alter the contents of the connection via a     man-in-the-middle attack.(CVE-2017-12151)

  - An information leak flaw was found in the way SMB1     protocol was implemented by Samba. A malicious client     could use this flaw to dump server memory contents to a     file on the samba share or to a shared printer, though     the exact area of server memory cannot be controlled by     the attacker.(CVE-2017-12163)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
110601	RHEL 6 : samba (RHSA-2018:1860)	Nessus	Red Hat Local Security Checks	2018/6/19	2025/4/15	medium
110604	RHEL 6 : samba4 (RHSA-2018:1883)	Nessus	Red Hat Local Security Checks	2018/6/19	2024/9/17	medium
110702	Oracle Linux 6 : samba (ELSA-2018-1860)	Nessus	Oracle Linux Local Security Checks	2018/6/27	2024/10/22	medium
110890	Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20180619)	Nessus	Scientific Linux Local Security Checks	2018/7/3	2024/9/6	medium
121068	Juniper Junos Space 18.4.x < 18.4R1 Multiple Vulnerabilities (JSA10917)	Nessus	Junos Local Security Checks	2019/1/10	2026/1/26	critical
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
108661	Debian DLA-1320-1 : samba security update	Nessus	Debian Local Security Checks	2018/3/28	2024/12/3	medium
110646	CentOS 6 : samba (CESA-2018:1860)	Nessus	CentOS Local Security Checks	2018/6/22	2024/9/17	medium
117320	RHEL 7 : samba (RHSA-2018:2613)	Nessus	Red Hat Local Security Checks	2018/9/6	2024/11/5	high
118282	SUSE SLES12 Security Update : samba (SUSE-SU-2018:2339-2)	Nessus	SuSE Local Security Checks	2018/10/22	2022/2/4	high
119781	Amazon Linux 2 : samba (ALAS-2018-1126)	Nessus	Amazon Linux Local Security Checks	2018/12/20	2024/7/15	high
123599	EulerOS 2.0 SP2 : samba (EulerOS-SA-2019-1125)	Nessus	Huawei Local Security Checks	2019/4/2	2024/6/6	high
123624	EulerOS 2.0 SP5 : samba (EulerOS-SA-2019-1150)	Nessus	Huawei Local Security Checks	2019/4/2	2024/6/6	high
123959	Debian DLA-1754-1 : samba security update	Nessus	Debian Local Security Checks	2019/4/10	2024/6/4	high
124911	EulerOS Virtualization for ARM 64 3.0.1.0 : samba (EulerOS-SA-2019-1408)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	critical
110891	Scientific Linux Security Update : samba on SL6.x i386/x86_64 (20180619)	Nessus	Scientific Linux Local Security Checks	2018/7/3	2024/9/6	high

检测

插件搜索

medium

medium

medium

medium

critical

critical

medium

medium

high

high

high

high

high

high

critical

high