smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - samba: SMB2 connections don't keep encryption across DFS redirects (CVE-2017-12151)

  - smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic     infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
    (CVE-2017-9461)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Various vulnerabilities were discovered in Samba, SMB/CIFS file, print, and login server/client for Unix

CVE-2017-9461

smbd in Samba had a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

CVE-2018-1050

Samba was vulnerable to a denial of service attack when the RPC spoolss service was configured to be run as an external daemon.
Missing input sanitization checks on some of the input parameters to spoolss RPC calls could have caused the print spooler service to crash.

CVE-2018-1057

On a Samba 4 AD DC the LDAP server of Samba incorrectly validated permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Thanks to the Ubuntu security team for having backported the rather invasive changeset to Samba in Ubuntu 14.04 (which we could use to patch Samba in Debian jessie LTS).

CVE-2019-3880

A flaw was found in the way Samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could have used this flaw to create a new registry hive file anywhere they had unix permissions which could have lead to creation of a new file in the Samba share.

For Debian 8 'Jessie', these problems have been fixed in version 2:4.2.14+dfsg-0+deb8u12.

We recommend that you upgrade your samba packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2778 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * A race condition was found in samba server. A malicious samba client could use this flaw to access files     and directories in areas of the server file system not exported under the share definitions.
    (CVE-2017-2619)

    * A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client     could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU     and memory. (CVE-2017-9461)

    Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn     (Google) as the original reporter of CVE-2017-2619.

    Bug Fix(es):

    * In the samba configuration, by default the 'posix locking' is enabled and 'stat cache' is disabled.
    Enabling 'posix locking' sends the file lock request to the bricks too, and disabling 'stat cache' blocks     samba to cache certain information at the samba layer. This led to decrease in performance of SMB access     of Red Hat Gluster Storage volumes

    As a fix, the following two options are included in the samba configuration file:
    posix locking = No     stat cache = Yes

    Due to this, a slight improvement in the performance is observed. (BZ#1436265)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way Samba handled dangling     symlinks. An authenticated malicious Samba client could     use this flaw to cause the smbd daemon to enter an     infinite loop and use an excessive amount of CPU and     memory. (CVE-2017-9461)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version:
samba (4.6.2). (BZ#1391954)

Security Fix(es) :

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
samba (4.6.2).

Security Fix(es) :

  - A flaw was found in the way Samba handled dangling     symlinks. An authenticated malicious Samba client could     use this flaw to cause the smbd daemon to enter an     infinite loop and use an excessive amount of CPU and     memory. (CVE-2017-9461)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1950 advisory.

    - resolves: #1450785 - Security fix for CVE-2017-7494
    - related: #1430260 - Security fix for CVE-2017-2619
    - resolves: #1430260 - Security fix for CVE-2017-2619

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for samba is now available for Red Hat Gluster Storage 3.2 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

Security Fix(es) :

* A race condition was found in samba server. A malicious samba client could use this flaw to access files and directories, in areas of the server file system not exported under the share definitions.
(CVE-2017-2619)

* A flaw was found in the way Samba handled dangling symlinks. An authenticated malicious Samba client could use this flaw to cause the smbd daemon to enter an infinite loop and use an excessive amount of CPU and memory. (CVE-2017-9461)

Red Hat would like to thank the Samba project for reporting CVE-2017-2619. Upstream acknowledges Jann Horn (Google) as the original reporter of CVE-2017-2619.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3348-1 advisory.

    It was discovered that Samba incorrectly handled dangling symlinks. A remote attacker could possibly use     this issue to cause Samba to hang, resulting in a denial of service. This issue only applied to Ubuntu     14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-9461)

    In addition, this update fixes a regression introduced by USN-3267-1 that caused Samba to incorrectly     handle non-wide symlinks to directories.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199042	RHEL 6 : samba4 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
123959	Debian DLA-1754-1 : samba security update	Nessus	Debian Local Security Checks	high
103453	RHEL 6 : samba (RHSA-2017:2778)	Nessus	Red Hat Local Security Checks	high
103078	EulerOS 2.0 SP2 : samba (EulerOS-SA-2017-1220)	Nessus	Huawei Local Security Checks	medium
103077	EulerOS 2.0 SP1 : samba (EulerOS-SA-2017-1219)	Nessus	Huawei Local Security Checks	medium
102745	CentOS 7 : samba (CESA-2017:1950)	Nessus	CentOS Local Security Checks	medium
102656	Scientific Linux Security Update : samba on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	medium
102290	Oracle Linux 7 : samba (ELSA-2017-1950)	Nessus	Oracle Linux Local Security Checks	medium
102156	RHEL 7 : Red Hat Gluster Storage (RHSA-2017:2338)	Nessus	Red Hat Local Security Checks	high
102106	RHEL 7 : samba (RHSA-2017:1950)	Nessus	Red Hat Local Security Checks	medium
101262	Ubuntu 14.04 LTS / 16.04 LTS : Samba vulnerability (USN-3348-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2017-9461

medium

Tenable Plugins

high

high

high

medium

medium

medium

medium

medium

high

medium

medium