A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code, cause a Denial       of Service condition, conduct a man-in-the-middle attack, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has samba packages installed that are affected by multiple vulnerabilities:

  - A null pointer dereference flaw was found in Samba RPC     external printer service. An attacker could use this     flaw to cause the printer spooler service to crash.
    (CVE-2018-1050)

  - A flaw was found in the way samba allowed the use of     weak NTLMv1 authentication even when NTLMv1 was     explicitly disabled. A man-in-the-middle attacker could     use this flaw to read the credential and other details     passed between the samba server and client.
    (CVE-2018-1139)

  - A heap-buffer overflow was found in the way samba     clients processed extra long filename in a directory     listing. A malicious samba server could use this flaw to     cause arbitrary code execution on a samba client.
    (CVE-2018-10858)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way samba allowed the use of     weak NTLMv1 authentication even when NTLMv1 was     explicitly disabled. A man-in-the-middle attacker could     use this flaw to read the credential and other details     passed between the samba server and     client.(CVE-2018-1139)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way samba allowed the use of     weak NTLMv1 authentication even when NTLMv1 was     explicitly disabled. A man-in-the-middle attacker could     use this flaw to read the credential and other details     passed between the samba server and     client.(CVE-2019-1139)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

The following security vulnerabilities were fixed :

  - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't     allow it; (bsc#1095048)

  - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and     DNS query with escapes crashes; (bsc#1095056)

  - CVE-2018-10919: Confidential attribute disclosure via     substring search; (bsc#1095057)

  - CVE-2018-10858: smbc_urlencode helper function is a     subject to buffer overflow; (bsc#1103411)

  - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames     on a user without a SPN; (bsc#1103414)

This update was imported from the SUSE:SLE-15:Update update project.

A NULL pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash. (CVE-2018-1050)

A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. (CVE-2018-10858)

A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.
(CVE-2018-1139)

Update to Samba 4.8.4, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues: The following security vulnerabilities were fixed :

  - CVE-2018-1139: Disable NTLMv1 auth if smb.conf doesn't     allow it; (bsc#1095048)

  - CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and     DNS query with escapes crashes; (bsc#1095056)

  - CVE-2018-10919: Confidential attribute disclosure via     substring search; (bsc#1095057)

  - CVE-2018-10858: smbc_urlencode helper function is a     subject to buffer overflow; (bsc#1103411)

  - CVE-2018-10918: Fix NULL ptr dereference in DsCrackNames     on a user without a SPN; (bsc#1103414)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference flaw was found in Samba RPC external printer service. An attacker could use this flaw to cause the printer spooler service to crash.(CVE-2018-1050)

A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client.(CVE-2018-10858)

A flaw was found in the way samba allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.(CVE-2018-1139)

An update for samba is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Samba is an open source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version:
samba (4.8.3). (BZ#1558560)

Security Fix(es) :

* samba: Weak authentication protocol regression (CVE-2018-1139)

* samba: Insufficient input validation in libsmbclient (CVE-2018-10858)

* samba: NULL pointer dereference in printer server process (CVE-2018-1050)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Samba project for reporting CVE-2018-1050. The CVE-2018-1139 issue was discovered by Vivek Das (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Security Fix(es) :

  - samba: Weak authentication protocol regression     (CVE-2018-1139)

  - samba: Insufficient input validation in libsmbclient     (CVE-2018-10858)

  - samba: NULL pointer dereference in printer server     process (CVE-2018-1050)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3056 advisory.

    - resolves: #1614265 - Fix CVE-2018-1139
    - resolves: #1614269 - Fix CVE-2018-10858

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3056 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    The following packages have been upgraded to a later upstream version: samba (4.8.3). (BZ#1558560)

    Security Fix(es):

    * samba: Weak authentication protocol regression (CVE-2018-1139)

    * samba: Insufficient input validation in libsmbclient (CVE-2018-10858)

    * samba: NULL pointer dereference in printer server process (CVE-2018-1050)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Samba project for reporting CVE-2018-1050. The CVE-2018-1139 issue was     discovered by Vivek Das (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2613 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: Weak authentication protocol regression (CVE-2018-1139)

    * samba: Insufficient input validation in libsmbclient (CVE-2018-10858)

    * samba: Null pointer indirection in printer server process (CVE-2018-1050)

    Red Hat would like to thank the Samba project for reporting CVE-2018-1139 and CVE-2018-1050. Upstream     acknowledges Vivek Das (Red Hat) as the original reporter of CVE-2018-1139.

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previously, sharing a subdirectory of a Gluster volume failed with an I/O error when the shadow_copy2     vfs object was specified. This occurred because Gluster volumes are remote file systems, and shadow_copy2     only detected share paths in the local file system. This update forces the value of shadow:mountpath to     '/', skipping the code related to mount point detection, and preventing this problem. However, this fix     requires that the glusterfs vfs object is listed after the shadow_copy2 vfs object in the smb.conf file.
    (BZ#1379444)

    * As of Red Hat Gluster Storage 3.4, the libldb package is no longer shipped as an independent package in     the Red Hat Gluster Storage Samba channel. The capabilities of the libldb package are now provided by a     combination of the samba-client and samba-client-libs packages. In addition, the sub-packages previously     provided by libldb are now provided by the samba-client and samba-client-libs packages. The samba-client     sub-package provides ldb-tools, and the samba-client-libs sub-package provides pyldb. (BZ#1592794)

    Enhancement(s):

    * Red Hat Gluster Storage volumes exported using SMB can now be mounted on macOS clients using Finder.
    Configuration instructions are provided as part of the Red Hat Gluster Storage 3.4 documentation.
    (BZ#1446125)

    Red Hat strongly recommends upgrading to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to Samba 4.7.9, Security fix for CVE-2018-1139, CVE-2018-1140, CVE-2018-10858, CVE-2018-10918, CVE-2018-10919

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Samba running on the remote host is 4.6.x prior to 4.6.16, or 4.7.x prior to 4.7.9, or 4.8.x prior to 4.8.4. It is, therefore, affected by multiple vulnerabilities.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3738-1 advisory.

    Svyatoslav Phirsov discovered that the Samba libsmbclient library incorrectly handled extra long     filenames. A malicious server could use this issue to cause Samba to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2018-10858)

    Volker Mauel discovered that Samba incorrectly handled database output. When used as an Active Directory     Domain Controller, a remote authenticated attacker could use this issue to cause Samba to crash, resulting     in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-10918)

    Phillip Kuhrt discovered that the Samba LDAP server incorrectly handled certain confidential attribute     values. A remote authenticated attacker could possibly use this issue to obtain certain sensitive     information. (CVE-2018-10919)

    Vivek Das discovered that Samba incorrectly handled NTLMv1 being explicitly disabled on the server. A     remote user could possibly be authenticated using NTLMv1, contrary to expectations. This issue only     affected Ubuntu 18.04 LTS. (CVE-2018-1139)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The samba project reports :

Samba releases 4.7.0 to 4.8.3 (inclusive) contain an error which allows authentication using NTLMv1 over an SMB1 transport (either directory or via NETLOGON SamLogon calls from a member server), even when NTLMv1 is explicitly disabled on the server.

Missing input sanitization checks on some of the input parameters to LDB database layer cause the LDAP server and DNS server to crash when following a NULL pointer.

Samba releases 3.2.0 to 4.8.3 (inclusive) contain an error in libsmbclient that could allow a malicious server to overwrite client heap memory by returning an extra long filename in a directory listing.

Missing database output checks on the returned directory attributes from the LDB database layer cause the DsCrackNames call in the DRSUAPI server to crash when following a NULL pointer.

All versions of the Samba Active Directory LDAP server from 4.0.0 onwards are vulnerable to the disclosure of confidential attribute values, both of attributes where the schema SEARCH_FLAG_CONFIDENTIAL (0x80) searchFlags bit and where an explicit Access Control Entry has been specified on the ntSecurityDescriptor.

ID	Name	Product	Family	Severity
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	critical
134927	GLSA-202003-52 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
127271	NewStart CGSL CORE 5.04 / MAIN 5.04 : samba Multiple Vulnerabilities (NS-SA-2019-0069)	Nessus	NewStart CGSL Local Security Checks	high
125570	EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2019-1618)	Nessus	Huawei Local Security Checks	high
125525	EulerOS 2.0 SP5 : samba (EulerOS-SA-2019-1598)	Nessus	Huawei Local Security Checks	high
123268	openSUSE Security Update : samba (openSUSE-2019-617)	Nessus	SuSE Local Security Checks	high
121359	Amazon Linux AMI : samba (ALAS-2018-1126)	Nessus	Amazon Linux Local Security Checks	high
120746	Fedora 28 : 2:samba / libldb (2018-bc22d6c7bc)	Nessus	Fedora Local Security Checks	high
120077	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:2318-1)	Nessus	SuSE Local Security Checks	high
119781	Amazon Linux 2 : samba (ALAS-2018-1126)	Nessus	Amazon Linux Local Security Checks	high
119691	CentOS 7 : samba (CESA-2018:3056)	Nessus	CentOS Local Security Checks	high
119198	Scientific Linux Security Update : samba on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
118766	Oracle Linux 7 : samba (ELSA-2018-3056)	Nessus	Oracle Linux Local Security Checks	high
118519	RHEL 7 : samba (RHSA-2018:3056)	Nessus	Red Hat Local Security Checks	high
117320	RHEL 7 : samba (RHSA-2018:2613)	Nessus	Red Hat Local Security Checks	high
112051	Fedora 27 : 2:samba (2018-8e4d871867)	Nessus	Fedora Local Security Checks	high
112000	openSUSE Security Update : samba (openSUSE-2018-891)	Nessus	SuSE Local Security Checks	high
111974	4.6.x < 4.6.16 / 4.7.x < 4.7.9 / 4.8.x < 4.8.4 Multiple Vulnerabilities	Nessus	Misc.	high
111748	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Samba vulnerabilities (USN-3738-1)	Nessus	Ubuntu Local Security Checks	high
111722	FreeBSD : samba -- multiple vulnerabilities (c4e9a427-9fc2-11e8-802a-000c29a1e3ec)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-1139

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high