Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.

The remote host is affected by the vulnerability described in GLSA-201502-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, bypass intended file restrictions,       or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

- Update to 4.1.3.

  + DCE-RPC fragment length field is incorrectly checked;
    CVE-2013-4408; (bnc#844720).

  + pam_winbind login without require_membership_of     restrictions; CVE-2012-6150; (bnc#853347).

  - Make use of the full gpg pub key file name including the     key ID.

  - Add transparent file compression support; (fate#316266).

  + Implement FSCTL_GET_COMPRESSION and     FSCTL_SET_COMPRESSION handlers.

  + Add FILE_ATTRIBUTE_COMPRESSED and FILE_NO_COMPRESSION     support.

  + Extend vfs_btrfs VFS module to utilize get/set     compression hooks.

  - Add support for FSCTL_SRV_COPYCHUNK_WRITE;
    (fate#314770).

  - Remove bogus libsmbclient0 package description and     cleanup the libsmbclient line from baselibs.conf;
    (bnc#853021).

  - BuildRequire systemd on post-12.2 systems.

  - Update to 4.1.2.

  + s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled;
    (bso#9091).

  + dfs_server: Use dsdb_search_one to catch 0 results as     well as NO_SUCH_OBJECT errors; (bso#10052).

  + Missing talloc_free can leak stackframe in error path;
    (bso#10187).

  + Fix memset used with constant zero length parameter;
    (bso#10190).

  + s4:dsdb/rootdse: report 'dnsHostName' instead of     'dNSHostName'; (bso#10193).

  + Make offline logon cache updating for cross child domain     group membership; (bso#10194).

  + nsswitch: Fix short writes in winbind_write_sock;
    (bso#10195).

  + RW Deny for a specific user is not overriding RW Allow     for a group; (bso#10196).

  + vfs_glusterfs: Fix excessive debug output from     vfs_gluster_open(); (bso#10224).

  + vfs_glusterfs: Implement proper mashalling/unmarshalling     of ACLs; (bso#10224).

  + VFS plugin was sending the actual size of the volume     instead of the total number of block units because of     which windows was getting the wrong &#9; volume     capacity; (bso#10224).

  + libcli/smb: Fix smb2cli_ioctl*() against Windows 2008;
    (bso#10232).

  + xattr: Fix listing EAs on *BSD for non-root users;
    (bso#10247).

  + Fix the build of vfs_glusterfs; (bso#10253).

  + s3-winbindd: Fix cache_traverse_validate_fn failure for     NDR cache entries; (bso#10264).

  + util: Remove 32bit macros breaking strict aliasing;
    (bso#10269).

  - Let gpg verify execution condition not fail on non SUSE     systems.

  - Add systemd support for post-12.2 systems.

  - Update to 4.1.1.

  + ACLs are not checked on opening an alternate data stream     on a file or directory; CVE-2013-4475; (bso#10229);
    (bnc#848101).

  + Private key in key.pem world readable; CVE-2013-4476;
    (bnc#848103).

Samba received bug and security fixes :

  - Unconditionally create the CUPS smb backend sym link     pointing to smbspool; (bnc#850656).

  - Private key in key.pem world readable; CVE-2013-4476;
    (bnc#848103).

  - ACLs are not checked on opening an alternate data stream     on a file or directory; CVE-2013-4475; (bso#10229);
    (bnc#848101).

Versions of Samba older than 3.6.20 / 4.0.11 / 4.1.1 are unpatched for the following two vulnerabilities:

  - Private key for SSL/TLS encryption is stored in a 'key.pem' file with world-readable permissions, which can allow a local attacker to extract sensitive information and decrypt network traffic. (CVE-2013-4476)

  - Versions of Samba 3.2.0 and above do not check the underlying file or directory ACL when opening an alternate data stream. (CVE-2013-4475)

The Samba project reports :

Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.

New samba packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

According to its banner, the version of Samba running on the remote host is 3.x prior to 3.6.20 or 4.0.x prior to 4.0.11 or 4.1.x prior to 4.1.1.  It is, therefore, potentially affected by multiple vulnerabilities :

  - A security bypass vulnerability may exist because Samba     does not properly enforce ACL restrictions when     accessing alternate data streams.  Either the     'vfs_streams_depot' or 'vfs_stream_xattr' module must     be enabled for the host to be vulnerable.
    (CVE-2013-4475)

  - Sensitive information may be obtained because the     private key used for SSL/TLS encryption is readable by     any local user.  Note that this only applies to     versions 4.0.x prior to 4.0.11 and 4.1.0.
    (CVE-2013-4476)

Further note that Nessus has relied only on the self-reported version number and has not actually tried to exploit this issue or determine if the associated patch has been applied.

ID	Name	Product	Family	Severity
81536	GLSA-201502-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
75242	openSUSE Security Update : samba (openSUSE-SU-2013:1921-1)	Nessus	SuSE Local Security Checks	high
75209	openSUSE Security Update : samba (openSUSE-SU-2013:1742-1)	Nessus	SuSE Local Security Checks	medium
8288	Samba < 3.6.20 / 4.0.11 / 4.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Samba	medium
70964	FreeBSD : samba -- Private key in key.pem world readable (479efd57-516e-11e3-9b62-000c292e4fd8)	Nessus	FreeBSD Local Security Checks	low
70953	Slackware 14.0 / 14.1 / current : samba (SSA:2013-322-03)	Nessus	Slackware Local Security Checks	medium
70926	Samba 3.x < 3.6.20 / 4.0.x < 4.0.11 / 4.1.x < 4.1.1 Multiple Vulnerabilities	Nessus	Misc.	medium

Detections

Analytics

CVE-2013-4476

medium

Tenable Plugins

critical

high

medium

medium

low

medium

medium