The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Samba on the remote host is 3.6.x prior to 3.6.24, 4.0.x prior to 4.0.19, or 4.1.x prior to 4.1.9 and is affected by the following vulnerabilities :

 - A denial of service flaw exists with 'nmbd'. A remote attacker, with a specially crafted packet, could cause the CPU to loop the same code segment, preventing further NetBIOS name services. (CVE-2014-0244)

 - A denial of service flaw exists with 'smbd' when an authenticated client makes a non-unicode request for a valid unicode path. An invalid return code from the conversion of bad unicode to Windows character set can cause memory at an offset from the expected return buffer to be overwritten. This could allow a remote authenticated attacker to cause a denial of service. (CVE-2014-3493)

Updated samba packages fix security vulnerabilities :

In Samba before 3.6.23, the SAMR server neglects to ensure that attempted password changes will update the bad password count, and does not set the lockout flags. This would allow a user unlimited attempts against the password by simply calling ChangePasswordUser2 repeatedly. This is available without any other authentication (CVE-2013-4496).

Information leak vulnerability in the VFS code, allowing an authenticated user to retrieve eight bytes of uninitialized memory when shadow copy is enabled (CVE-2014-0178).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are vulnerable to a denial of service on the nmbd NetBIOS name services daemon. A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS ame service (CVE-2014-0244).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are affected by a denial of service crash involving overwriting memory on an authenticated connection to the smbd file server (CVE-2014-3493).

An uninitialized pointer use flaw was found in the Samba daemon (smbd). A malicious Samba client could send specially crafted netlogon packets that, when processed by smbd, could potentially lead to arbitrary code execution with the privileges of the user running smbd (by default, the root user) (CVE-2015-0240).

The remote host is affected by the vulnerability described in GLSA-201502-15 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code,       cause a Denial of Service condition, bypass intended file restrictions,       or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - The sys_recvfrom function in nmbd in Samba 3.6.x before     3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9     allows remote attackers to cause a denial of service     (infinite loop and CPU consumption) via a malformed UDP     packet. (CVE-2014-0244)

  - The push_ascii function in smbd in Samba 3.6.x before     3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9     allows remote authenticated users to cause a denial of     service (memory corruption and daemon crash) via an     attempt to read a Unicode pathname without specifying     use of Unicode, leading to a character-set conversion     failure that triggers an invalid pointer dereference.
    (CVE-2014-3493)

Update to Samba 4.0.21. CVE-2014-3560.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated samba4 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in Samba's NetBIOS message block daemon (nmbd). An attacker on the local network could use this flaw to send specially crafted packets that, when processed by nmbd, could possibly lead to arbitrary code execution with root privileges.
(CVE-2014-3560)

All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the smb service will be restarted automatically.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0867 advisory.

  - samba: Uninitialized memory exposure (CVE-2014-0178)

  - samba: nmbd denial of service (CVE-2014-0244)

  - samba: smbd unicode path names denial of service (CVE-2014-3493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0867 advisory.

    - resolves: #1105504 - CVE-2014-0244: DoS in nmbd.
    - resolves: #1108844 - CVE-2014-3493: DoS in smbd with unicode path names.
    - resolves: #1105573 - CVE-2014-0178: Uninitialized memory exposure.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Samba has been updated to fix two security issues and one non-security issue.

These security issues have been fixed :

  - Fix segmentation fault in smbd_marshal_dir_entry()'s     SMB_FIND_FILE_UNIXhandler. (CVE-2014-3493)

  - Fix nmbd denial of service. (CVE-2014-0244)

  - Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response     (CVE-2014-0178) These non-security issues have been     fixed :

  - Fix printer job purging; (bso#10612);. (bnc#879390)

Updated samba packages fix security vulnerabilities :

Information leak vulnerability in the VFS code, allowing an authenticated user to retrieve eight bytes of uninitialized memory when shadow copy is enabled (CVE-2014-0178).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are vulnerable to a denial of service on the nmbd NetBIOS name services daemon. A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS name service (CVE-2014-0244).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are affected by a denial of service crash involving overwriting memory on an authenticated connection to the smbd file server (CVE-2014-3493).

A denial of service flaw was found in the way the sys_recvfile() function of nmbd, the NetBIOS message block daemon, processed non-blocking sockets. An attacker could send a specially crafted packet that, when processed, would cause nmbd to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2014-0244)

It was discovered that smbd, the Samba file server daemon, did not properly handle certain files that were stored on the disk and used a valid Unicode character in the file name. An attacker able to send an authenticated non-Unicode request that attempted to read such a file could cause smbd to crash. (CVE-2014-3493)

After installing this update, the smb service will be restarted automatically.

Updated samba3x and samba packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A denial of service flaw was found in the way the sys_recvfile() function of nmbd, the NetBIOS message block daemon, processed non-blocking sockets. An attacker could send a specially crafted packet that, when processed, would cause nmbd to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2014-0244)

It was discovered that smbd, the Samba file server daemon, did not properly handle certain files that were stored on the disk and used a valid Unicode character in the file name. An attacker able to send an authenticated non-Unicode request that attempted to read such a file could cause smbd to crash. (CVE-2014-3493)

Red Hat would like to thank Daniel Berteaud of FIREWALL-SERVICES SARL for reporting CVE-2014-0244, and the Samba project for reporting CVE-2014-3493. The Samba project acknowledges Simon Arlott as the original reporter of CVE-2014-3493.

All Samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0866 advisory.

    - resolves: #1105499 - CVE-2014-0244: DoS in nmbd.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated samba packages that fix three security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A denial of service flaw was found in the way the sys_recvfile() function of nmbd, the NetBIOS message block daemon, processed non-blocking sockets. An attacker could send a specially crafted packet that, when processed, would cause nmbd to enter an infinite loop and consume an excessive amount of CPU time. (CVE-2014-0244)

A flaw was found in the way Samba created responses for certain authenticated client requests when a shadow-copy VFS module was enabled. An attacker able to send an authenticated request could use this flaw to disclose limited portions of memory per each request.
(CVE-2014-0178)

It was discovered that smbd, the Samba file server daemon, did not properly handle certain files that were stored on the disk and used a valid Unicode character in the file name. An attacker able to send an authenticated non-Unicode request that attempted to read such a file could cause smbd to crash. (CVE-2014-3493)

Red Hat would like to thank Daniel Berteaud of FIREWALL-SERVICES SARL for reporting CVE-2014-0244, and the Samba project for reporting CVE-2014-0178 and CVE-2014-3493. The Samba project acknowledges Christof Schmitt as the original reporter of CVE-2014-0178, and Simon Arlott as the original reporter of CVE-2014-3493.

All Samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

samba was updated to version 4.1.9 to fix four security issues and various non-security bugs.

These security issues were fixed :

  - Fix nmbd denial of service (CVE-2014-0244)

  - Fix segmentation fault in smbd_marshall_dir_entry()'s     SMB_FIND_FILE_UNIX handler (CVE-2014-3493)

  - Malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response     (CVE-2014-0178)

  - DNS: Don't reply to replies (CVE-2014-0239)

samba was updated to fix three security issues and two non-security issues. &#9; These security issues were fixed :

  - Fix segmentation fault in smbd_marshall_dir_entry()'s     SMB_FIND_FILE_UNIX handler (CVE-2014-3493)

  - Fix nmbd denial of service (CVE-2014-0244)

  - Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response     (CVE-2014-0178)

These non-security issues were fixed :

  - Fix printer job purging; (bso#10612); (bnc#879390).

  - Package the get_printing_ticket binary with 0700     permissions on post-11.4 systems; (bnc#685093).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2257-1 advisory.

    Christof Schmitt discovered that Samba incorrectly initialized a certain response field when vfs shadow     copy was enabled. A remote authenticated attacker could use this issue to possibly obtain sensitive     information. This issue only affected Ubuntu 13.10 and Ubuntu 14.04 LTS. (CVE-2014-0178)

    It was discovered that the Samba internal DNS server incorrectly handled QR fields when processing     incoming DNS messages. A remote attacker could use this issue to cause Samba to consume resources,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0239)

    Daniel Berteaud discovered that the Samba NetBIOS name service daemon incorrectly handled certain     malformed packets. A remote attacker could use this issue to cause Samba to consume resources, resulting     in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS.
    (CVE-2014-0244)

    Simon Arlott discovered that Samba incorrectly handled certain unicode path names. A remote authenticated     attacker could use this issue to cause Samba to stop responding, resulting in a denial of service.
    (CVE-2014-3493)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to Samba 4.1.9. Update to Samba 4.1.8 (CVE-2014-0178 samba:
Uninitialized memory exposure)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New samba packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

According to its banner, the version of Samba on the remote host is 3.6.x prior to 3.6.24, 4.0.x prior to 4.0.19, or 4.1.x prior to 4.1.9. It is, therefore, affected by the following vulnerabilities :

  - A denial of service flaw exists with 'nmbd'. A remote     attacker, with a specially crafted packet, could     cause the CPU to loop the same code segment, preventing     further NetBIOS name services. (CVE-2014-0244)

  - A denial of service flaw exists with 'smbd' when an     authenticated client makes a non-unicode request for a     valid unicode path. An invalid return code from the     conversion of bad unicode to Windows character set can     cause memory at an offset from the expected return     buffer to be overwritten. This could allow a remote     authenticated attacker to cause a denial of service.
    (CVE-2014-3493)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The samba project reports :

A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS name service.

Valid unicode path names stored on disk can cause smbd to crash if an authenticated client attempts to read them using a non-unicode request.

Multiple vulnerabilities were discovered and fixed in Samba, a SMB/CIFS file, print, and login server :

  - CVE-2014-0178     Information leak vulnerability in the VFS code, allowing     an authenticated user to retrieve eight bytes of     uninitialized memory when shadow copy is enabled.

  - CVE-2014-0244     Denial of service (infinite CPU loop) in the nmbd     Netbios name service daemon. A malformed packet can     cause the nmbd server to enter an infinite loop,     preventing it to process later requests to the Netbios     name service.

  - CVE-2014-3493     Denial of service (daemon crash) in the smbd file server     daemon. An authenticated user attempting to read a     Unicode path using a non-Unicode request can force the     daemon to overwrite memory at an invalid address.

ID	Name	Product	Family	Severity
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	critical
8757	Samba 3.6.x < 3.6.24 / 4.0.x < 4.0.19 / 4.1.x < 4.1.9 Multiple Vulnerabilities	Nessus Network Monitor	Samba	medium
82335	Mandriva Linux Security Advisory : samba (MDVSA-2015:082)	Nessus	Mandriva Local Security Checks	critical
81536	GLSA-201502-15 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
80769	Oracle Solaris Third-Party Patch Update : samba (multiple_vulnerabilities_in_samba1)	Nessus	Solaris Local Security Checks	low
77268	Fedora 19 : samba-4.0.21-1.fc19 (2014-9132)	Nessus	Fedora Local Security Checks	high
77013	RHEL 6 : samba4 (RHSA-2014:1009)	Nessus	Red Hat Local Security Checks	high
77006	CentOS 6 : samba4 (CESA-2014:1009)	Nessus	CentOS Local Security Checks	high
76903	RHEL 7 : samba (RHSA-2014:0867)	Nessus	Red Hat Local Security Checks	medium
76740	Oracle Linux 7 : samba (ELSA-2014-0867)	Nessus	Oracle Linux Local Security Checks	high
76523	SuSE 11.3 Security Update : Samba (SAT Patch Number 9451)	Nessus	SuSE Local Security Checks	low
76480	Mandriva Linux Security Advisory : samba (MDVSA-2014:136)	Nessus	Mandriva Local Security Checks	low
76449	Scientific Linux Security Update : samba and samba3x on SL5.x, SL6.x i386/srpm/x86_64 (20140709)	Nessus	Scientific Linux Local Security Checks	low
76447	RHEL 5 / 6 : samba and samba3x (RHSA-2014:0866)	Nessus	Red Hat Local Security Checks	low
76443	Oracle Linux 5 / 6 : samba / and / samba3x (ELSA-2014-0866)	Nessus	Oracle Linux Local Security Checks	high
76432	CentOS 7 : samba (CESA-2014:0867)	Nessus	CentOS Local Security Checks	low
76431	CentOS 5 / 6 : samba / samba3x (CESA-2014:0866)	Nessus	CentOS Local Security Checks	low
76341	openSUSE Security Update : samba (openSUSE-SU-2014:0859-1)	Nessus	SuSE Local Security Checks	medium
76340	openSUSE Security Update : samba (openSUSE-SU-2014:0857-1)	Nessus	SuSE Local Security Checks	low
76275	Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2257-1)	Nessus	Ubuntu Local Security Checks	high
76223	Fedora 20 : samba-4.1.9-3.fc20 (2014-7672)	Nessus	Fedora Local Security Checks	high
76207	Slackware 14.0 / 14.1 / current : samba (SSA:2014-175-04)	Nessus	Slackware Local Security Checks	medium
76202	Samba 3.6.x < 3.6.24 / 4.0.x < 4.0.19 / 4.1.x < 4.1.9 Multiple Vulnerabilities	Nessus	Misc.	low
76196	FreeBSD : samba -- multiple vulnerabilities (6ad309d9-fb03-11e3-bebd-000c2980a9f3)	Nessus	FreeBSD Local Security Checks	low
76194	Debian DSA-2966-1 : samba - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2014-0244

high

Tenable Plugins

critical

medium

critical

critical

low

high

high

high

medium

high

low

low

low

low

high

low

low

medium

low

high

high

medium

low

low

low