There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer.

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while other local variables still point at the original buffer.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3563 advisory.

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a     malicious server can supply a pathname to the client with separators. This could allow the client to     access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to     create files outside of the current working directory using the privileges of the client user.
    (CVE-2019-10218)

  - A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba     4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active     Directory Domain Controller can be configured to use a custom script to check for password complexity.
    This configuration can fail to verify password complexity when non-ASCII characters are used in the     password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary     attacks. (CVE-2019-14833)

  - A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash     AD DC LDAP server via dirsync resulting in denial of service. Privilege escalation is not possible with     this issue. (CVE-2019-14847)

  - There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and     all samba 4.9.x versions before 4.9.18, where the removal of the right to create or modify a subtree would     not automatically be taken away on all domain controllers. (CVE-2019-14902)

  - All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where     if it is set with log level = 3 (or above) then the string obtained from the client, after a failed     character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange.
    In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to     terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a     crash there is harmless). (CVE-2019-14907)

  - There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions     before 4.10.12 and all samba 4.11.x versions before 4.11.5, essentially due to a call to realloc() while     other local variables still point at the original buffer. (CVE-2019-19344)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - There is a use-after-free issue in all samba 4.9.x     versions before 4.9.18, all samba 4.10.x versions     before 4.10.12 and all samba 4.11.x versions before     4.11.5, essentially due to a call to realloc() while     other local variables still point at the original     buffer.(CVE-2019-19344)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - There is a use-after-free issue in all samba 4.9.x     versions before 4.9.18, all samba 4.10.x versions     before 4.10.12 and all samba 4.11.x versions before     4.11.5, essentially due to a call to realloc() while     other local variables still point at the original     buffer.(CVE-2019-19344)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202003-52 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code, cause a Denial       of Service condition, conduct a man-in-the-middle attack, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Update to Samba 4.10.13

----

Update to Samba 4.10.12 - Security fixes for CVE-2019-14902, CVE-2019-14907 and CVE-2019-19344

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Samba 4.11.6

----

Update to Samba 4.11.5 - Security fixes for CVE-2019-14902, CVE-2019-14907 and CVE-2019-19344

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

Security issues fixed :

  - CVE-2019-14907: Fixed a Server-side crash after charset     conversion failure during NTLMSSP processing     (bsc#1160888).

  - CVE-2019-14902: Fixed an issue where automatic     replication of ACLs down subtree on AD Directory is not     working (bsc#1160850).

  - CVE-2019-19344: Fixed a server crash when using dns zone     scavenging = yes (bsc#1160852).

Non-security issue fixed :

  - Fixed Ceph snapshot path handling relative to root     (bsc#1141320).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for samba fixes the following issues :

Security issues fixed :

CVE-2019-14907: Fixed a Server-side crash after charset conversion failure during NTLMSSP processing (bsc#1160888).

CVE-2019-14902: Fixed an issue where automatic replication of ACLs down subtree on AD Directory is not working (bsc#1160850).

CVE-2019-19344: Fixed a server crash when using dns zone scavenging = yes (bsc#1160852).

Non-security issue fixed :

Fixed Ceph snapshot path handling relative to root (bsc#1141320).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Samba Team reports :

CVE-2019-14902

The implementation of ACL inheritance in the Samba AD DC was not complete, and so absent a 'full-sync' replication, ACLs could get out of sync between domain controllers.

CVE-2019-14907

When processing untrusted string input Samba can read past the end of the allocated buffer when printing a 'Conversion error' message to the logs.

CVE-2019-19344

During DNS zone scavenging (of expired dynamic entries) there is a read of memory after it has been freed.

The version of Samba running on the remote host is 4.x prior to 4.9.18, 4.10.x prior to 4.10.12, or 4.11.x prior to 4.11.5.  It is, therefore, affected by multiple vulnerabilities:

  - An issue exists with ACL inheritance due to added or removed delegated rights not being inherited across     domain controllers. An authenticated, remote attacker can exploit this to create or remove a subtree when     the permission should have been removed from the user. (CVE-2019-14902)

  - A denial of service (DoS) vulnerability exists due to Samba incorrectly converting characters printed     during the NTLMSSP exchange when the log level is set to 3. An authenticated, remote attacker can exploit     this issue, to cause some long-lived processes like the RPC server to stop responding. (CVE-2019-14907)

  - A use-after-free error exists in the code used to 'tombstone' dynamically created DNS records that have     reached their expiry time, due to an improper realloc() call. An authenticated, remote attacker may be     able to exploit this to cause read memory to be written to the DB. (CVE-2019-19344)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4244-1 advisory.

    It was discovered that Samba did not automatically replicate ACLs set to inherit down a subtree on AD     Directory, contrary to expectations. This issue was only addressed in Ubuntu 18.04 LTS, Ubuntu 19.04 and     Ubuntu 19.10. (CVE-2019-14902)

    Robert wicki discovered that Samba incorrectly handled certain character conversions when the log     level is set to 3 or above. In certain environments, a remote attacker could possibly use this issue to     cause Samba to crash, resulting in a denial of service. (CVE-2019-14907)

    Christian Naumer discovered that Samba incorrectly handled DNS zone scavenging. This issue could possibly     result in some incorrect data being written to the DB. This issue only applied to Ubuntu 19.04 and Ubuntu     19.10. (CVE-2019-19344)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
502451	Synology DiskStation Manager Samba Use After Free (CVE-2019-19344)	Tenable OT Security	Tenable.ot	medium
181444	Debian DLA-3563-1 : samba - LTS security update	Nessus	Debian Local Security Checks	medium
137803	EulerOS Virtualization for ARM 64 3.0.6.0 : samba (EulerOS-SA-2020-1696)	Nessus	Huawei Local Security Checks	medium
135744	EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-1511)	Nessus	Huawei Local Security Checks	medium
134927	GLSA-202003-52 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
133586	Fedora 30 : 2:samba (2020-f92cd0e72b)	Nessus	Fedora Local Security Checks	medium
133425	Fedora 31 : 2:samba (2020-6bd386c7eb)	Nessus	Fedora Local Security Checks	medium
133343	openSUSE Security Update : samba (openSUSE-2020-122)	Nessus	SuSE Local Security Checks	medium
133254	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2020:0223-1)	Nessus	SuSE Local Security Checks	medium
133244	FreeBSD : samba -- multiple vulnerabilities (5f0dd349-40a2-11ea-8d8c-005056a311d1)	Nessus	FreeBSD Local Security Checks	medium
133210	Samba 4.x < 4.9.18 / 4.10.x < 4.10.12 / 4.11.x < 4.11.5 Multiple Vulnerabilities	Nessus	Misc.	medium
133178	Ubuntu 16.04 LTS / 18.04 LTS : Samba vulnerabilities (USN-4244-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2019-19344

medium

Tenable Plugins

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium