The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the samba package has been released.

The remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code, cause a Denial       of Service condition, conduct a man-in-the-middle attack, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The Samba Active Directory LDAP server was vulnerable     to an information disclosure flaw because of missing     access control checks. An authenticated attacker could     use this flaw to extract confidential attribute values     using LDAP search expressions. Samba versions before     4.6.16, 4.7.9 and 4.8.4 are vulnerable.(CVE-2018-10919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

The following security vulnerabilities were fixed :

  - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't     allow it; (bsc#1095048)

  - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and     DNS query with escapes crashes; (bsc#1095056)

  - CVE-2018-10919: Confidential attribute disclosure via     substring search; (bsc#1095057)

  - CVE-2018-10858: smbc_urlencode helper function is a     subject to buffer overflow; (bsc#1103411)

  - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames     on a user without a SPN; (bsc#1103414)

This update was imported from the SUSE:SLE-15:Update update project.

Update to Samba 4.8.4, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues: The following security vulnerabilities were fixed :

  - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't     allow it; (bsc#1095048)

  - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and     DNS query with escapes crashes; (bsc#1095056)

  - CVE-2018-10919: Confidential attribute disclosure via     substring search; (bsc#1095057)

  - CVE-2018-10858: smbc_urlencode helper function is a     subject to buffer overflow; (bsc#1103411)

  - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames     on a user without a SPN; (bsc#1103414)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Samba was updated to 4.6.15, bringing bug and security fixes.
(bsc#1110943)

Following security issues were fixed :

  - CVE-2018-10919: Fix unauthorized attribute access via     searches. (bsc#1095057);

Non-security bugs fixed :

  - Fix ctdb_mutex_ceph_rados_helper deadlock (bsc#1102230).

  - Allow idmap_rid to have primary group other than 'Domain     Users' (bsc#1087931).

  - winbind: avoid using fstrcpy in _dual_init_connection.

  - Fix ntlm authentications with 'winbind use default     domain = yes' (bsc#1068059).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

Samba was updated to 4.6.15, bringing bug and security fixes.
(bsc#1110943)

Following security issues were fixed :

CVE-2018-10919: Fix unauthorized attribute access via searches.
(bsc#1095057);

Non-security bugs fixed: Fix ctdb_mutex_ceph_rados_helper deadlock (bsc#1102230).

Allow idmap_rid to have primary group other than 'Domain Users' (bsc#1087931).

winbind: avoid using fstrcpy in _dual_init_connection.

Fix ntlm authentications with 'winbind use default domain = yes' (bsc#1068059).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.7.9, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New samba packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The version of Samba running on the remote host is 4.6.x prior to 4.6.16, or 4.7.x prior to 4.7.9, or 4.8.x prior to 4.8.4. It is, therefore, affected by multiple vulnerabilities.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3738-1 advisory.

    Svyatoslav Phirsov discovered that the Samba libsmbclient library incorrectly handled extra long     filenames. A malicious server could use this issue to cause Samba to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2018-10858)

    Volker Mauel discovered that Samba incorrectly handled database output. When used as an Active Directory     Domain Controller, a remote authenticated attacker could use this issue to cause Samba to crash, resulting     in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10918)

    Phillip Kuhrt discovered that the Samba LDAP server incorrectly handled certain confidential attribute     values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive     information. (CVE-2018-10919)

    Vivek Das discovered that Samba incorrectly handled NTLMv1 being explicitly disabled on the server. A     remote user could possibly be authenticated using NTLMv1, contrary to expectations. This issue only     affected Ubuntu 18.04 LTS. (CVE-2018-1139)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The samba project reports :

Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which allows authentication using NTLMv1 over an SMB1 transport (either directory or via NETLOGON SamLogon calls from a member server), even when NTLMv1 is explicitly disabled on the server.

Missing input sanitization checks on some of the input parameters to LDB database layer cause the LDAP server and DNS server to crash when following a NULL pointer.

Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in libsmbclient that could allow a malicious server to overwrite client heap memory by returning an extra long filename in a directory listing.

Missing database output checks on the returned directory attributes from the LDB database layer cause the DsCrackNames call in the DRSUAPI server to crash when following a NULL pointer.

All versions of the Samba Active Directory LDAP server from 4.0.0 onwards are vulnerable to the disclosure of confidential attribute values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL (0x80) searchFlags bit and where an explicit Access Control Entry has been specified on the ntSecurityDescriptor.

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2018-10858     Svyatoslav Phirsov discovered that insufficient input     validation in libsmbclient allowed a malicious Samba     server to write to the client's heap memory.

  - CVE-2018-10919     Phillip Kuhrt discovered that Samba when acting as an     Active Domain controller disclosed some sensitive     attributes.

ID	Name	Product	Family	Severity
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	critical
204371	Photon OS 5.0: Samba PHSA-2023-5.0-0063	Nessus	PhotonOS Local Security Checks	medium
204289	Photon OS 4.0: Samba PHSA-2023-4.0-0443	Nessus	PhotonOS Local Security Checks	medium
134927	GLSA-202003-52 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
131637	EulerOS 2.0 SP2 : samba (EulerOS-SA-2019-2484)	Nessus	Huawei Local Security Checks	medium
123268	openSUSE Security Update : samba (openSUSE-2019-617)	Nessus	SuSE Local Security Checks	high
120746	Fedora 28 : 2:samba / libldb (2018-bc22d6c7bc)	Nessus	Fedora Local Security Checks	high
120077	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:2318-1)	Nessus	SuSE Local Security Checks	high
118196	openSUSE Security Update : samba (openSUSE-2018-1195)	Nessus	SuSE Local Security Checks	medium
118172	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2018:3161-1)	Nessus	SuSE Local Security Checks	medium
112051	Fedora 27 : 2:samba (2018-8e4d871867)	Nessus	Fedora Local Security Checks	high
112000	openSUSE Security Update : samba (openSUSE-2018-891)	Nessus	SuSE Local Security Checks	high
111996	Slackware 14.0 / 14.1 / 14.2 / current : samba (SSA:2018-229-02)	Nessus	Slackware Local Security Checks	high
111974	4.6.x < 4.6.16 / 4.7.x < 4.7.9 / 4.8.x < 4.8.4 Multiple Vulnerabilities	Nessus	Misc.	high
111748	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Samba vulnerabilities (USN-3738-1)	Nessus	Ubuntu Local Security Checks	high
111722	FreeBSD : samba -- multiple vulnerabilities (c4e9a427-9fc2-11e8-802a-000c29a1e3ec)	Nessus	FreeBSD Local Security Checks	high
111706	Debian DSA-4271-1 : samba - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-10919

medium

Tenable Plugins

critical

medium

medium

critical

medium

high

high

high

medium

medium

high

high

high

high

high

high

high