A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - samba: SMB2 connections don't keep encryption across DFS redirects (CVE-2017-12151)

  - smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic     infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
    (CVE-2017-9461)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A null pointer dereference flaw was found in Samba RPC     external printer service. An attacker could use this     flaw to cause the printer spooler service to     crash.(CVE-2018-1050)

  - A heap-buffer overflow was found in the way samba     clients processed extra long filename in a directory     listing. A malicious samba server could use this flaw     to cause arbitrary code execution on a samba client.
    (CVE-2018-10858)

  - A use-after-free flaw was found in the way samba     servers handled certain SMB1 requests. An     unauthenticated attacker could send specially-crafted     SMB1 requests to cause the server to crash or execute     arbitrary code.(CVE-2017-14746)

  - A memory disclosure flaw was found in samba. An     attacker could retrieve parts of server memory, which     could contain potentially sensitive data, by sending     specially-crafted requests to the samba     server.(CVE-2017-15275)

  - It was found that samba did not enforce 'SMB signing'     when certain configuration options were enabled. A     remote attacker could launch a man-in-the-middle attack     and retrieve information in plain-text.(CVE-2017-12150)

  - A flaw was found in the way samba client used     encryption with the max protocol set as SMB3. The     connection could lose the requirement for signing and     encrypting to any DFS redirects, allowing an attacker     to read or alter the contents of the connection via a     man-in-the-middle attack.(CVE-2017-12151)

  - An information leak flaw was found in the way SMB1     protocol was implemented by Samba. A malicious client     could use this flaw to dump server memory contents to a     file on the samba share or to a shared printer, though     the exact area of server memory cannot be controlled by     the attacker.(CVE-2017-12163)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

Security issues fixed :

  - CVE-2017-14746: Use-after-free vulnerability     (bsc#1060427).

  - CVE-2017-15275: Server heap memory information leak     (bsc#1063008).

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file (bsc#1058624).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

  - CVE-2017-12150: Some code path don't enforce smb signing     when they should (bsc#1058565).

Bug fixes :

  - Samba was updated to 4.6.9 (bsc#1065066) see release     notes for details.

  - https://www.samba.org/samba/history/samba-4.6.9.html

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for samba fixes the following issues: Security issues fixed :

  - CVE-2017-14746: Use-after-free vulnerability     (bsc#1060427).

  - CVE-2017-15275: Server heap memory information leak     (bsc#1063008).

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file (bsc#1058624).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

  - CVE-2017-12150: Some code path don't enforce smb signing     when they should (bsc#1058565). Bug fixes :

  - Samba was updated to 4.6.9 (bsc#1065066) see release     notes for details.

  - https://www.samba.org/samba/history/samba-4.6.9.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes several issues. These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624).

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Server memory information leak over SMB1 :

An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)

SMB2 connections don't keep encryption across DFS redirects

A flaw was found in the way samba client used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack. (CVE-2017-12151)

Some code path don't enforce smb signing, when they should

It was found that samba did not enforce 'SMB signing' when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
(CVE-2017-12150)

This update for samba fixes several issues.

These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624)

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622)

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565)

The following non-security issue was fixed :

  - Fix GUID string format on GetPrinter info request.
    (bsc#1050707)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for samba fixes several issues.

These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624).

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

These non-security issues were fixed :

  - Fixed error where short name length was read as 2 bytes,     should be 1 (bsc#1042419)

  - Fixed GUID string format on GetPrinter to prevent     published printers from disappearing 7 (bsc#1050707).

  - Halt endless forest trust scan to prevent winbind from     running out of memory (bsc#1044084).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for samba fixes several issues. These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624)

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622)

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that samba did not enforce 'SMB signing'     when certain configuration options were enabled. A     remote attacker could launch a man-in-the-middle attack     and retrieve information in plain-text.
    (CVE-2017-12150)

  - A flaw was found in the way samba client used     encryption with the max protocol set as SMB3. The     connection could lose the requirement for signing and     encrypting to any DFS redirects, allowing an attacker     to read or alter the contents of the connection via a     man-in-the-middle attack. (CVE-2017-12151)

  - An information leak flaw was found in the way SMB1     protocol was implemented by Samba. A malicious client     could use this flaw to dump server memory contents to a     file on the samba share or to a shared printer, though     the exact area of server memory cannot be controlled by     the attacker. (CVE-2017-12163)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2858 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * It was found that samba did not enforce SMB signing when certain configuration options were enabled. A     remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
    (CVE-2017-12150)

    * A flaw was found in the way samba client used encryption with the max protocol set as SMB3. The     connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an     attacker to read or alter the contents of the connection via a man-in-the-middle attack. (CVE-2017-12151)

    * An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client     could use this flaw to dump server memory contents to a file on the samba share or to a shared printer,     though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)

    Red Hat would like to thank the Samba project for reporting CVE-2017-12150 and CVE-2017-12151 and Yihan     Lian and Zhibin Hu (Qihoo 360 GearTeam), Stefan Metzmacher (SerNet), and Jeremy Allison (Google) for     reporting CVE-2017-12163. Upstream acknowledges Stefan Metzmacher (SerNet) as the original reporter of     CVE-2017-12150 and CVE-2017-12151.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Samba running on the remote host is 4.4.x prior to 4.4.16, 4.5.x prior to 4.5.14, or 4.6.x prior to 4.6.8. It is, therefore, affected by the following vulnerabilities:

  - Signing requirements are not properly enforced for SMB v1, v2,     and v3. This could allow a man-in-the-middle attacker to     interfere with client connections. (CVE-2017-12150)

  - A flaw exists with the DFS redirect that causes encryption     requirements to not be maintained. A man-in-the-middle attacker     could read or alter the client connection. (CVE-2017-12151)

  - A flaw exists with SMB v1 due to improper range check for client     write requests. An authenticated attacker could potentially access     sensitive server information. (CVE-2017-12163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2790 advisory.

    [4.6.2-11]
    - resolves: #1491213 - CVE-2017-12150 CVE-2017-12151 CVE-2017-12163

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been discoverd in Samba, a SMB/CIFS file, print, and login server for Unix :

  - CVE-2017-12150     Stefan Metzmacher discovered multiple code paths where     SMB signing was not enforced.

  - CVE-2017-12151     Stefan Metzmacher discovered that tools using     libsmbclient did not enforce encryption when following     DFS redirects, which could allow a man-in-the-middle     attacker to read or modify connections which were meant     to be encrypted.

  - CVE-2017-12163     Yihan Lian and Zhibin Hu discovered that insufficient     range checks in the processing of SMB1 write requests     could result in disclosure of server memory.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3426-1 advisory.

    Stefan Metzmacher discovered that Samba incorrectly enforced SMB signing in certain situations. A remote     attacker could use this issue to perform a machine-in-the-middle attack. (CVE-2017-12150)

    Stefan Metzmacher discovered that Samba incorrectly handled encryption across DFS redirects. A remote     attacker could use this issue to perform a machine-in-the-middle attack. (CVE-2017-12151)

    Yihan Lian and Zhibin Hu discovered that Samba incorrectly handled memory when SMB1 is being used. A     remote attacker could possibly use this issue to obtain server memory contents. (CVE-2017-12163)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was found that samba did not enforce 'SMB signing'     when certain configuration options were enabled. A     remote attacker could launch a man- in-the-middle attack     and retrieve information in plain-text. (CVE-2017-12150)

  - A flaw was found in the way samba client used encryption     with the max protocol set as SMB3. The connection could     lose the requirement for signing and encrypting to any     DFS redirects, allowing an attacker to read or alter the     contents of the connection via a man-in-the-middle     attack. (CVE-2017-12151)

  - An information leak flaw was found in the way SMB1     protocol was implemented by Samba. A malicious client     could use this flaw to dump server memory contents to a     file on the samba share or to a shared printer, though     the exact area of server memory cannot be controlled by     the attacker. (CVE-2017-12163)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2790 advisory.

  - samba: Some code path don't enforce smb signing, when they should (CVE-2017-12150)

  - samba: SMB2 connections don't keep encryption across DFS redirects (CVE-2017-12151)

  - Samba: Server memory information leak over SMB1 (CVE-2017-12163)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* It was found that samba did not enforce 'SMB signing' when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
(CVE-2017-12150)

* A flaw was found in the way samba client used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack. (CVE-2017-12151)

* An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)

Red Hat would like to thank the Samba project for reporting CVE-2017-12150 and CVE-2017-12151 and Yihan Lian and Zhibin Hu (Qihoo 360 GearTeam), Stefan Metzmacher (SerNet), and Jeremy Allison (Google) for reporting CVE-2017-12163. Upstream acknowledges Stefan Metzmacher (SerNet) as the original reporter of CVE-2017-12150 and CVE-2017-12151.

New samba packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

ID	Name	Product	Family	Severity
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	critical
199042	RHEL 6 : samba4 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
124911	EulerOS Virtualization for ARM 64 3.0.1.0 : samba (EulerOS-SA-2019-1408)	Nessus	Huawei Local Security Checks	critical
105999	Fedora 27 : 2:samba (2017-f0c18420e8)	Nessus	Fedora Local Security Checks	high
105218	openSUSE Security Update : samba (openSUSE-2017-1316)	Nessus	SuSE Local Security Checks	critical
104962	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:3155-1)	Nessus	SuSE Local Security Checks	critical
104529	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:2971-1)	Nessus	SuSE Local Security Checks	high
103893	Fedora 25 : 2:samba (2017-581be259ef)	Nessus	Fedora Local Security Checks	high
103854	SUSE SLES12 Security Update : samba (SUSE-SU-2017:2726-1)	Nessus	SuSE Local Security Checks	high
103822	Amazon Linux AMI : samba (ALAS-2017-909)	Nessus	Amazon Linux Local Security Checks	high
103807	SUSE SLES12 Security Update : samba (SUSE-SU-2017:2704-1)	Nessus	SuSE Local Security Checks	high
103801	openSUSE Security Update : samba (openSUSE-2017-1147)	Nessus	SuSE Local Security Checks	high
103800	openSUSE Security Update : samba (openSUSE-2017-1146)	Nessus	SuSE Local Security Checks	high
103770	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:2695-1)	Nessus	SuSE Local Security Checks	high
103736	EulerOS 2.0 SP2 : samba (EulerOS-SA-2017-1234)	Nessus	Huawei Local Security Checks	high
103735	EulerOS 2.0 SP1 : samba (EulerOS-SA-2017-1233)	Nessus	Huawei Local Security Checks	high
103690	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:2650-1)	Nessus	SuSE Local Security Checks	high
103685	RHEL 6 / 7 : samba (RHSA-2017:2858)	Nessus	Red Hat Local Security Checks	high
103535	Samba 4.4.x < 4.4.16 / 4.5.x < 4.5.14 / 4.6.x < 4.6.8 Multiple Vulnerabilities	Nessus	Misc.	high
103490	Oracle Linux 7 : samba (ELSA-2017-2790)	Nessus	Oracle Linux Local Security Checks	high
103434	Fedora 26 : 2:samba (2017-5a0a31c04e)	Nessus	Fedora Local Security Checks	high
103432	Debian DSA-3983-1 : samba - security update	Nessus	Debian Local Security Checks	high
103416	Ubuntu 14.04 LTS / 16.04 LTS : Samba vulnerabilities (USN-3426-1)	Nessus	Ubuntu Local Security Checks	high
103411	Scientific Linux Security Update : samba on SL7.x x86_64 (20170921)	Nessus	Scientific Linux Local Security Checks	high
103407	RHEL 7 : samba (RHSA-2017:2790)	Nessus	Red Hat Local Security Checks	high
103386	CentOS 7 : samba (CESA-2017:2790)	Nessus	CentOS Local Security Checks	high
103361	Slackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2017-263-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2017-12151

high

Tenable Plugins

critical

high

critical

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high