NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Samba on the remote host is 4.x prior to 4.0.21 / 4.1.x prior to 4.1.11 and is affected by a flaw in the NetBIOS name services daemon (nmbd). This flaw may allow an attacker to execute arbitrary code as the superuser.

This samba update fixes the following security and non security issues :

  - Fix winbind service parameter usage; (bnc#890005).

  - lib/param: change the default for 'winbind expand     groups' to '0'; (bnc#890008).

  - Update to 4.1.11.

  + A malicious browser can send packets that may overwrite     the heap of the target nmbd NetBIOS name services     daemon; CVE-2014-3560; (bnc#889429).

  - Fix 'net time' segfault; (bso#10728); (bnc#889539).

  - Update to 4.1.10.

  + net/doc: Make clear that net vampire is for NT4 domains     only; (bso#3263).

  + dbcheck: Add check and test for various invalid     userParameters values; (bso#8077).

  + s4:dsdb/samldb: Don't allow 'userParameters' to be     modified over LDAP for now; (bso#8077).

  + Simple use case results in 'no talloc stackframe around,     leaking memory' error; (bso#8449).

  + s4:dsdb/repl_meta_data: Make sure objectGUID can't be     deleted; (bso#9763).

  + dsdb: Always store and return the userParameters as a     array of LE 16-bit values; (bso#10130).

  + s4:repl_meta_data: fix array assignment in     replmd_process_linked_attribute(); (bso#10294).

  + ldb-samba: fix a memory leak in     ldif_canonicalise_objectCategory(); (bso#10469).

  + dbchecker: Verify and fix broken dn values; (bso#10536).

  + dsdb: Rename private_data to rootdse_private_data in     rootdse; (bso#10582).

  + s3: libsmbclient: Work around bugs in SLES cifsd and     Apple smbx SMB1 servers; (bso#10587).

  + Fix 'PANIC: assert failed at     ../source3/smbd/open.c(1582): ret'; (bso#10593).

  + rid_array used before status checked - segmentation     fault due to NULL pointer dereference; (bso#10627).

  + Samba won't start on a machine configured with only     IPv4; (bso#10653).

  + msg_channel: Fix a 100% CPU loop; (bso#10663).

  + s3: smbd: Prevent file truncation on an open that fails     with share mode violation; (bso#10671); (bnc#884056).

  + s3: SMB2: Fix leak of blocking lock records in the     database; (bso#10673).

  + samba-tool: Add --site parameter to provision command;
    (bso#10674).

  + smbstatus: Fix an uninitialized variable; (bso#10680).

  + SMB1 blocking locks can fail notification on unlock,     causing client timeout; (bso#10684).

  + s3: smbd: Locking, fix off-by one calculation in     brl_pending_overlap(); (bso#10685).

  + 'RW2' smbtorture test fails when -N <numprocs> is set to     2 due to the invalid status check in the second client;
    (bso#10687).

  + wbcCredentialCache fails if challenge_blob is not first;
    (bso#10692).

  + Backport ldb-1.1.17 + changes from master; (bso#10693).

  + Fix SEGV from improperly formed SUBSTRING/PRESENCE     filter; (bso#10693).

  + ldb: Add a env variable to disable RTLD_DEEPBIND;
    (bso#10693).

  + ldb: Do not build libldb-cmdline when using system ldb;
    (bso#10693).

  + ldb: Fix 1138330 Dereference null return value, fix CIDs     241329, 240798, 1034791, 1034792 1034910, 1034910);
    (bso#10693).

  + ldb: make the successful ldb_transaction_start() message     clearer; (bso#10693).

  + ldb:pyldb: Add some more helper functions for LdbDn;
    (bso#10693).

  + ldb: Use of NULL pointer bugfix; (bso#10693).

  + lib/ldb: Fix compiler warnings; (bso#10693).

  + pyldb: Decrement ref counters on py_results and quiet     warnings; (bso#10693).

  + s4-openldap: Remove use of talloc_reference in     ldb_map_outbound.c; (bso#10693).

  + dsdb: Return NO_SUCH_OBJECT if a basedn is a deleted     object; (bso#10694).

  + s4:dsdb/extended_dn_in: Don't force     DSDB_SEARCH_SHOW_RECYCLED; (bso#10694).

  + Backport autobuild/selftest fixes from master;
    (bso#10696).

  + Backport drs-crackname fixes from master; (bso#10698).

  + smbd: Avoid double-free in get_print_db_byname;
    (bso#10699).

  + Backport access check related fixes from master;
    (bso#10700).

  + Backport provision fixes from master; (bso#10703).

  + s3:smb2_read: let smb2_sendfile_send_data() behave like     send_file_readX(); (bso#10706).

  + s3: Fix missing braces in nfs4_acls.c.

  - Add missing newline to debug message in daemon_ready();
    (bnc#865627).

  - BuildRequire systemd-devel, configure --with-systemd,     and modify the service files accordingly on post-12.2     systems; (bso#10517); (bnc#865627).

  - Prevent file truncation on an open that fails with share     mode violation; (bso#10671); (bnc#884056).

Dependend libraries were version updated :

libtdb was updated to version 1.3.0. (lots of bugfixes, some new functionality) libtevent was updated to 0.9.21. (lots of bugfixes, some new functionality) libldb was updated to to 1.1.17 (lots of bugfixes, some new functionality) libtalloc was updated to 2.1.1.
(lots of bugfixes, some new functionality)

Update to Samba 4.0.21. CVE-2014-3560.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

resolves: #1126015 - Fix CVE-2014-3560

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated samba packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in Samba's NetBIOS message block daemon (nmbd). An attacker on the local network could use this flaw to send specially crafted packets that, when processed by nmbd, could possibly lead to arbitrary code execution with root privileges.
(CVE-2014-3560)

This update also fixes the following bug :

* Prior to this update, Samba incorrectly used the O_TRUNC flag when using the open(2) system call to access the contents of a file that was already opened by a different process, causing the file's previous contents to be removed. With this update, the O_TRUNC flag is no longer used in the above scenario, and file corruption no longer occurs. (BZ#1115490)

All Samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

A heap-based buffer overflow flaw was found in Samba's NetBIOS message block daemon (nmbd). An attacker on the local network could use this flaw to send specially crafted packets that, when processed by nmbd, could possibly lead to arbitrary code execution with root privileges.
(CVE-2014-3560)

After installing this update, the smb service will be restarted automatically.

Updated samba4 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in Samba's NetBIOS message block daemon (nmbd). An attacker on the local network could use this flaw to send specially crafted packets that, when processed by nmbd, could possibly lead to arbitrary code execution with root privileges.
(CVE-2014-3560)

All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the smb service will be restarted automatically.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1008 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) or     Common Internet File System (CIFS) protocol, which allows PC-compatible     machines to share files, printers, and other information.

    A heap-based buffer overflow flaw was found in Samba's NetBIOS message     block daemon (nmbd). An attacker on the local network could use this flaw     to send specially crafted packets that, when processed by nmbd, could     possibly lead to arbitrary code execution with root privileges.
    (CVE-2014-3560)

    This update also fixes the following bug:

    * Prior to this update, Samba incorrectly used the O_TRUNC flag when using     the open(2) system call to access the contents of a file that was already     opened by a different process, causing the file's previous contents to be     removed. With this update, the O_TRUNC flag is no longer used in the above     scenario, and file corruption no longer occurs. (BZ#1115490)

    All Samba users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing this     update, the smb service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-1009 advisory.

    - resolves: #1126011 - CVE-2014-3560: remote code execution in nmbd.
    - resolves: #1105501 - CVE-2014-0244: DoS in nmbd.
    - resolves: #1108842 - CVE-2014-3493: DoS in smbd with unicode path names.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2014:1008 :

Updated samba packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A heap-based buffer overflow flaw was found in Samba's NetBIOS message block daemon (nmbd). An attacker on the local network could use this flaw to send specially crafted packets that, when processed by nmbd, could possibly lead to arbitrary code execution with root privileges.
(CVE-2014-3560)

This update also fixes the following bug :

* Prior to this update, Samba incorrectly used the O_TRUNC flag when using the open(2) system call to access the contents of a file that was already opened by a different process, causing the file's previous contents to be removed. With this update, the O_TRUNC flag is no longer used in the above scenario, and file corruption no longer occurs. (BZ#1115490)

All Samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2305-1 advisory.

    Volker Lendecke discovered that the Samba NetBIOS name service daemon incorrectly handled certain memory     operations. A remote attacker could use this issue to execute arbitrary code as the root user.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Samba developers report :

A malicious browser can send packets that may overwrite the heap of the target nmbd NetBIOS name services daemon. It may be possible to use this to generate a remote code execution vulnerability as the superuser (root).

New samba packages are available for Slackware 14.1 and -current to fix a security issue.

According to its banner, the version of Samba on the remote host is 4.x prior to 4.0.21 / 4.1.11. It is, therefore, affected by a flaw in the NetBIOS name services daemon (nmbd). This flaw may allow an attacker to execute arbitrary code as the superuser.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	critical
8759	Samba 4.x < 4.0.21 / 4.1.x < 4.1.11 nmbd Remote Code Execution	Nessus Network Monitor	Samba	high
77296	openSUSE Security Update : samba (openSUSE-SU-2014:1040-1)	Nessus	SuSE Local Security Checks	high
77268	Fedora 19 : samba-4.0.21-1.fc19 (2014-9132)	Nessus	Fedora Local Security Checks	high
77073	Fedora 20 : samba-4.1.9-4.fc20 (2014-9141)	Nessus	Fedora Local Security Checks	high
77058	CentOS 7 : samba (CESA-2014:1008)	Nessus	CentOS Local Security Checks	high
77017	Scientific Linux Security Update : samba4 on SL6.x i386/x86_64 (20140805)	Nessus	Scientific Linux Local Security Checks	high
77013	RHEL 6 : samba4 (RHSA-2014:1009)	Nessus	Red Hat Local Security Checks	high
77012	RHEL 7 : samba (RHSA-2014:1008)	Nessus	Red Hat Local Security Checks	critical
77010	Oracle Linux 6 : samba4 (ELSA-2014-1009)	Nessus	Oracle Linux Local Security Checks	critical
77009	Oracle Linux 7 : samba (ELSA-2014-1008)	Nessus	Oracle Linux Local Security Checks	high
77006	CentOS 6 : samba4 (CESA-2014:1009)	Nessus	CentOS Local Security Checks	high
76991	Ubuntu 14.04 LTS : Samba vulnerability (USN-2305-1)	Nessus	Ubuntu Local Security Checks	critical
76985	FreeBSD : samba -- remote code execution (89ff45e3-1a57-11e4-bebd-000c2980a9f3)	Nessus	FreeBSD Local Security Checks	high
76974	Slackware 14.1 / current : samba (SSA:2014-213-01)	Nessus	Slackware Local Security Checks	high
76973	Samba 4.x < 4.0.21 / 4.1.11 nmbd Remote Code Execution	Nessus	Misc.	high

Detections

Analytics

CVE-2014-3560

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

critical

critical

high

high

critical

high

high

high