Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Samba was updated to fix a security issue :

Samba, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS). (CVE-2013-4475)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201502-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, bypass intended file restrictions,       or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before     4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot     or vfs_streams_xattr is enabled, allows remote attackers     to bypass intended file restrictions by leveraging ACL     differences between a file and an associated alternate     data stream (ADS). (CVE-2013-4475)

Updated samba packages that fix two security issues are now available for Red Hat Storage.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in the DCE-RPC client code in Samba. A specially crafted DCE-RPC packet could cause various Samba programs to crash or, possibly, execute arbitrary code when parsed. A malicious or compromised Active Directory Domain Controller could use this flaw to compromise the winbindd daemon running with root privileges. (CVE-2013-4408)

A flaw was found in the way Samba performed ACL checks on alternate file and directory data streams. An attacker able to access a CIFS share with alternate stream support enabled could access alternate data streams regardless of the underlying file or directory ACL permissions. (CVE-2013-4475)

Red Hat would like to thank the Samba project for reporting CVE-2013-4408. Upstream acknowledges Stefan Metzmacher and Michael Adam of SerNet as the original reporters of this issue.

All users of Red Hat Storage are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing this update, the smb service will be restarted automatically.

Update to Samba 4.0.21. CVE-2014-3560.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 4.1.3.

  + DCE-RPC fragment length field is incorrectly checked;
    CVE-2013-4408; (bnc#844720).

  + pam_winbind login without require_membership_of     restrictions; CVE-2012-6150; (bnc#853347).

  - Make use of the full gpg pub key file name including the     key ID.

  - Add transparent file compression support; (fate#316266).

  + Implement FSCTL_GET_COMPRESSION and     FSCTL_SET_COMPRESSION handlers.

  + Add FILE_ATTRIBUTE_COMPRESSED and FILE_NO_COMPRESSION     support.

  + Extend vfs_btrfs VFS module to utilize get/set     compression hooks.

  - Add support for FSCTL_SRV_COPYCHUNK_WRITE;
    (fate#314770).

  - Remove bogus libsmbclient0 package description and     cleanup the libsmbclient line from baselibs.conf;
    (bnc#853021).

  - BuildRequire systemd on post-12.2 systems.

  - Update to 4.1.2.

  + s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled;
    (bso#9091).

  + dfs_server: Use dsdb_search_one to catch 0 results as     well as NO_SUCH_OBJECT errors; (bso#10052).

  + Missing talloc_free can leak stackframe in error path;
    (bso#10187).

  + Fix memset used with constant zero length parameter;
    (bso#10190).

  + s4:dsdb/rootdse: report 'dnsHostName' instead of     'dNSHostName'; (bso#10193).

  + Make offline logon cache updating for cross child domain     group membership; (bso#10194).

  + nsswitch: Fix short writes in winbind_write_sock;
    (bso#10195).

  + RW Deny for a specific user is not overriding RW Allow     for a group; (bso#10196).

  + vfs_glusterfs: Fix excessive debug output from     vfs_gluster_open(); (bso#10224).

  + vfs_glusterfs: Implement proper mashalling/unmarshalling     of ACLs; (bso#10224).

  + VFS plugin was sending the actual size of the volume     instead of the total number of block units because of     which windows was getting the wrong &#9; volume     capacity; (bso#10224).

  + libcli/smb: Fix smb2cli_ioctl*() against Windows 2008;
    (bso#10232).

  + xattr: Fix listing EAs on *BSD for non-root users;
    (bso#10247).

  + Fix the build of vfs_glusterfs; (bso#10253).

  + s3-winbindd: Fix cache_traverse_validate_fn failure for     NDR cache entries; (bso#10264).

  + util: Remove 32bit macros breaking strict aliasing;
    (bso#10269).

  - Let gpg verify execution condition not fail on non SUSE     systems.

  - Add systemd support for post-12.2 systems.

  - Update to 4.1.1.

  + ACLs are not checked on opening an alternate data stream     on a file or directory; CVE-2013-4475; (bso#10229);
    (bnc#848101).

  + Private key in key.pem world readable; CVE-2013-4476;
    (bnc#848103).

the following security issues were fixed in samba :

  - ACLs are not checked on opening an alternate data stream     on a file or directory; CVE-2013-4475; (bso#10229);
    (bnc#848101).

  - Fix memleak in reload_printers_full(); (bso#9993).

  - Valid utf8 filenames cause 'invalid conversion error'     messages; (bso#10139).

  - s3: smb2 breaks 'smb encryption = mandatory';
    (bso#10167).

  - Missing talloc_free can leak stackframe in error path;
    (bso#10187).

  - Offline logon cache not updating for cross child domain     group membership; (bso#10194).

  - The preceding bugs are tracked by (bnc#849226) too.

  - Make Samba work on site with Read Only Domain     Controller; (bso#5917).

  - Give machine password changes 10 minutes of time;
    (bso#8955).

  - NetrServerPasswordSet2 timeout is too short; (bso#8955).

  - Fix fallback to ncacn_np in cm_connect_lsat();
    (bso#9615); (bso#9899).

  - s3-winbind: Do not delete an existing valid credential     cache; (bso#9994).

  - 'net ads join': Fix segmentation fault in     create_local_private_krb5_conf_for_domain; (bso#10073).

  - Fix variable list in man vfs_crossrename; (bso#10076).

  - MacOSX 10.9 will not follow path-based DFS referrals     handed out by Samba; (bso#10097).

  - Honour output buffer length set by the client for SMB2     GetInfo requests; (bso#10106).

  - Handle Dropbox (write-only-directory) case correctly in     pathname lookup; (bso#10114).

  - Fix 'smbstatus' as non-root user; (bso#10127).

  - The preceding bugs are tracked by (bnc#849226) too.

  - Windows 8 Roaming profiles fail; (bso#9678).

  - Linux kernel oplock breaks can miss signals;
    (bso#10064).

  - The preceding bugs are tracked by (bnc#849226) too.

  - Verify source tar ball gpg signature.

  - Store and return the correct spoolss jobid in     notifications; (bnc#838472).

  - Reload snums before processing the printer list.
    (bnc#817880).

Samba received bug and security fixes :

  - Unconditionally create the CUPS smb backend sym link     pointing to smbspool; (bnc#850656).

  - Private key in key.pem world readable; CVE-2013-4476;
    (bnc#848103).

  - ACLs are not checked on opening an alternate data stream     on a file or directory; CVE-2013-4475; (bso#10229);
    (bnc#848101).

Versions of Samba older than 3.6.20 / 4.0.11 / 4.1.1 are unpatched for the following two vulnerabilities:

  - Private key for SSL/TLS encryption is stored in a 'key.pem' file with world-readable permissions, which can allow a local attacker to extract sensitive information and decrypt network traffic. (CVE-2013-4476)

  - Versions of Samba 3.2.0 and above do not check the underlying file or directory ACL when opening an alternate data stream. (CVE-2013-4475)

This update fixes the following security issues with samba :

  - DCERPC frag_len not checked. (CVE-2013-4408).
    (bnc#844720)

  - winbind pam security problem. (CVE-2012-6150).
    (bnc#853347)

  - No access check verification on stream files     (CVE-2013-4475). And fixes the following non-security     issues :. (bnc#848101)

  - libsmbclient0 package description contains comments.
    (bnc#853021)

  - rpcclient adddriver and setdrive do not set all needed     registry entries. (bnc#817880)

  - Client trying to delete print job fails: Samba returns:
    WERR_INVALID_PRINTER_NAME. (bnc#838472)

  - various upstream fixes. (bnc#854520 and bnc#849226)

According to its banner, the version of Samba running on this system (i.e., earlier than 3.6.22 / 4.0.13 / 4.1.3) contain the following known vulnerabilities:

  - A security bypass vulnerability via the 'winbind_name_list_to_sid_string_list()' that would allow a malicious authenticated user to modify the 'pam_winbind' configuration file. (CVE-2012-6150)

  - A buffer overflow vulnerability in the 'dcerpc_read_ncacn_packet_done()' function that can allow remote AD domain controllers to execute arbitrary code (CVE-2013-4408)

  - ACLs were not checked when opening files with alternate data streams, though this issue is only exploitable if the VFS modules vfs_streams_depot and/or vfs_streams_xattr are used. (CVE-2013-4475)

It was discovered that Winbind incorrectly handled invalid group names with the require_membership_of parameter. If an administrator used an invalid group name by mistake, access was granted instead of having the login fail. (CVE-2012-6150)

Stefan Metzmacher and Michael Adam discovered that Samba incorrectly handled DCE-RPC fragment length fields. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly execute arbitrary code as the root user. (CVE-2013-4408)

Hemanth Thummala discovered that Samba incorrectly handled file permissions when vfs_streams_depot or vfs_streams_xattr were enabled.
A remote attacker could use this issue to bypass intended restrictions. (CVE-2013-4475).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A heap-based buffer overflow flaw was found in the DCE-RPC client code in Samba. A specially crafted DCE-RPC packet could cause various Samba programs to crash or, possibly, execute arbitrary code when parsed. A malicious or compromised Active Directory Domain Controller could use this flaw to compromise the winbindd daemon running with root privileges. (CVE-2013-4408)

A flaw was found in the way Samba performed ACL checks on alternate file and directory data streams. An attacker able to access a CIFS share with alternate stream support enabled could access alternate data streams regardless of the underlying file or directory ACL permissions. (CVE-2013-4475)

After installing this update, the smb service will be restarted automatically.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1806 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) or     Common Internet File System (CIFS) protocol, which allows PC-compatible     machines to share files, printers, and other information.

    A heap-based buffer overflow flaw was found in the DCE-RPC client code in     Samba. A specially crafted DCE-RPC packet could cause various Samba     programs to crash or, possibly, execute arbitrary code when parsed.
    A malicious or compromised Active Directory Domain Controller could use     this flaw to compromise the winbindd daemon running with root privileges.
    (CVE-2013-4408)

    A flaw was found in the way Samba performed ACL checks on alternate file     and directory data streams. An attacker able to access a CIFS share with     alternate stream support enabled could access alternate data streams     regardless of the underlying file or directory ACL permissions.
    (CVE-2013-4475)

    Red Hat would like to thank the Samba project for reporting CVE-2013-4408.
    Upstream acknowledges Stefan Metzmacher and Michael Adam of SerNet as the     original reporters of this issue.

    All users of Samba are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing this     update, the smb service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1806 advisory.

    - resolves: #1018037 - Fix CVE-2013-4408.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two security issues were found in Samba, a SMB/CIFS file, print, and login server :

  - CVE-2013-4408     It was discovered that multiple buffer overflows in the     processing of DCE-RPC packets may lead to the execution     of arbitrary code.

  - CVE-2013-4475     Hemanth Thummala discovered that ACLs were not checked     when opening files with alternate data streams. This     issue is only exploitable if the VFS modules     vfs_streams_depot and/or vfs_streams_xattr are used.

Updated samba3x and samba packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in the DCE-RPC client code in Samba. A specially crafted DCE-RPC packet could cause various Samba programs to crash or, possibly, execute arbitrary code when parsed. A malicious or compromised Active Directory Domain Controller could use this flaw to compromise the winbindd daemon running with root privileges. (CVE-2013-4408)

A flaw was found in the way Samba performed ACL checks on alternate file and directory data streams. An attacker able to access a CIFS share with alternate stream support enabled could access alternate data streams regardless of the underlying file or directory ACL permissions. (CVE-2013-4475)

Red Hat would like to thank the Samba project for reporting CVE-2013-4408. Upstream acknowledges Stefan Metzmacher and Michael Adam of SerNet as the original reporters of this issue.

All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

Security update to fix CVE-2013-4475. Add glusterfs VFS module.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2013-4475.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in samba :

Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS) (CVE-2013-4475).

The updated packages has been upgraded to the 3.6.20 version which resolves various upstream bugs and is not vulnerable to this issue.

The Samba project reports :

Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x, 3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying file or directory ACL when opening an alternate data stream.

According to the SMB1 and SMB2+ protocols the ACL on an underlying file or directory should control what access is allowed to alternate data streams that are associated with the file or directory.

New samba packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

According to its banner, the version of Samba running on the remote host is 3.x prior to 3.6.20 or 4.0.x prior to 4.0.11 or 4.1.x prior to 4.1.1.  It is, therefore, potentially affected by multiple vulnerabilities :

  - A security bypass vulnerability may exist because Samba     does not properly enforce ACL restrictions when     accessing alternate data streams.  Either the     'vfs_streams_depot' or 'vfs_stream_xattr' module must     be enabled for the host to be vulnerable.
    (CVE-2013-4475)

  - Sensitive information may be obtained because the     private key used for SSL/TLS encryption is readable by     any local user.  Note that this only applies to     versions 4.0.x prior to 4.0.11 and 4.1.0.
    (CVE-2013-4476)

Further note that Nessus has relied only on the self-reported version number and has not actually tried to exploit this issue or determine if the associated patch has been applied.

ID	Name	Product	Family	Severity
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	critical
83629	SUSE SLES11 Security Update : Samba (SUSE-SU-2014:0839-1)	Nessus	SuSE Local Security Checks	medium
81536	GLSA-201502-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
80765	Oracle Solaris Third-Party Patch Update : samba (cve_2013_4475_access_control)	Nessus	Solaris Local Security Checks	medium
78991	RHEL 6 : Storage Server (RHSA-2014:0009)	Nessus	Red Hat Local Security Checks	high
77268	Fedora 19 : samba-4.0.21-1.fc19 (2014-9132)	Nessus	Fedora Local Security Checks	high
75242	openSUSE Security Update : samba (openSUSE-SU-2013:1921-1)	Nessus	SuSE Local Security Checks	high
75215	openSUSE Security Update : samba (openSUSE-SU-2013:1787-1)	Nessus	SuSE Local Security Checks	medium
75209	openSUSE Security Update : samba (openSUSE-SU-2013:1742-1)	Nessus	SuSE Local Security Checks	medium
8288	Samba < 3.6.20 / 4.0.11 / 4.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Samba	medium
71833	SuSE 11.2 / 11.3 Security Update : Samba (SAT Patch Numbers 8655 / 8656)	Nessus	SuSE Local Security Checks	high
8075	Samba < 3.6.22 / 4.0.13 / 4.1.3 Multiple Vulnerabilities	Nessus Network Monitor	Samba	high
71376	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 / 13.10 : samba vulnerabilities (USN-2054-1)	Nessus	Ubuntu Local Security Checks	high
71341	Scientific Linux Security Update : samba and samba3x on SL5.x, SL6.x i386/x86_64 (20131210)	Nessus	Scientific Linux Local Security Checks	high
71293	RHEL 5 / 6 : samba and samba3x (RHSA-2013:1806)	Nessus	Red Hat Local Security Checks	critical
71289	Oracle Linux 5 / 6 : samba / and / samba3x (ELSA-2013-1806)	Nessus	Oracle Linux Local Security Checks	critical
71275	Debian DSA-2812-1 : samba - several vulnerabilities	Nessus	Debian Local Security Checks	high
71274	CentOS 5 / 6 : samba / samba3x (CESA-2013:1806)	Nessus	CentOS Local Security Checks	high
71083	Fedora 20 : samba-4.1.1-1.fc20 (2013-21088)	Nessus	Fedora Local Security Checks	medium
71059	Fedora 18 : samba-4.0.11-1.fc18 (2013-21207)	Nessus	Fedora Local Security Checks	medium
71032	Mandriva Linux Security Advisory : samba (MDVSA-2013:278)	Nessus	Mandriva Local Security Checks	medium
70994	Fedora 19 : samba-4.0.11-1.fc19 (2013-21094)	Nessus	Fedora Local Security Checks	medium
70966	FreeBSD : samba -- ACLs are not checked on opening an alternate data stream on a file or directory (a4f08579-516c-11e3-9b62-000c292e4fd8)	Nessus	FreeBSD Local Security Checks	medium
70953	Slackware 14.0 / 14.1 / current : samba (SSA:2013-322-03)	Nessus	Slackware Local Security Checks	medium
70926	Samba 3.x < 3.6.20 / 4.0.x < 4.0.11 / 4.1.x < 4.1.1 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2013-4475

high

Tenable Plugins

critical

medium

critical

medium

high

high

high

medium

medium

medium

high

high

high

high

critical

critical

high

high

medium

medium

medium

medium

medium

medium

medium