A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2022-3fd94cef3e advisory.

    Update to version 4.16.4 to address security fixes for CVE-2022-32742, CVE-2022-32744, CVE-2022-32745,     CVE-2022-32746

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - krb5: Buffer overflow in get_matching_data() (CVE-2017-15088)

  - Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

  - The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka     krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote     authenticated users to forge tickets by leveraging administrative access. (CVE-2014-5351)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0137 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

    * ipa: Invalid CSRF protection (CVE-2023-5455)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0252 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix(es):

    * Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

    * ipa: Invalid CSRF protection (CVE-2023-5455)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0143 advisory.

    - Resolves: 2242828 Invalid CSRF protection (CVE-2023-5455)

    ipa-healthcheck     opendnssec     python-jwcrypto     python-kdcproxy

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0143 advisory.

 - A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD. (CVE-2020-17049)

 - A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection.
 Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt. (CVE-2023-5455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0143 advisory.

 - A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD. (CVE-2020-17049)

 - A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection.
 Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt. (CVE-2023-5455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0143 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

    * ipa: Invalid CSRF protection (CVE-2023-5455)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0139 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

    * ipa: Invalid CSRF protection (CVE-2023-5455)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0143 advisory.

 - A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD. (CVE-2020-17049)

 - A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection.
 Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt. (CVE-2023-5455)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202309-06 (Samba: Multiple Vulnerabilities)

  - Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in     Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in     filenames in a TAR archive, a related issue to CVE-2001-1267. (CVE-2007-4559)

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - Kerberos Security Feature Bypass Vulnerability (CVE-2020-17049)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC     (read-only domain controller). This would allow an RODC to print administrator tickets. (CVE-2020-25718)

  - A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise. (CVE-2020-25719)

  - Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now     provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.
    (CVE-2020-25721)

  - Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored     data. An attacker could use this flaw to cause total domain compromise. (CVE-2020-25722)

  - MaxQueryDuration not honoured in Samba AD DC LDAP (CVE-2021-3670)

  - In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections     via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb     database. However while the database was correctly shared, the user credentials state was only pointed at,     and when one connection within that association group ended, the database would be left pointing at an     invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-     after-free could instead allow different user state to be pointed at and this might allow more privileged     access. (CVE-2021-3738)

  - A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute     force attacks being successful if special conditions are met. (CVE-2021-20251)

  - A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

  - A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large     DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data,     bypassing the signature requirements. (CVE-2021-23192)

  - All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
    (CVE-2021-44141)

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

  - The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that     SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an     account modification re-adds an SPN that was previously present on that account, such as one added when a     computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to     perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an     attacker who can intercept traffic can impersonate existing services, resulting in a loss of     confidentiality and integrity. (CVE-2022-0336)

  - In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. (CVE-2022-1615)

  - A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a     single account and set of keys, allowing them to decrypt each other's tickets. A user who has been     requested to change their password, can exploit this flaw to obtain and use tickets to other services.
    (CVE-2022-2031)

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

  - A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will     make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported     part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside     the 'smbd' configured share path and gain access to another restricted server's filesystem.
    (CVE-2022-3592)

  - A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer). (CVE-2022-32742)

  - Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit     unprivileged users to write it. (CVE-2022-32743)

  - A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By     encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling     full domain takeover. (CVE-2022-32744)

  - A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP     add or modify the request, usually resulting in a segmentation fault. (CVE-2022-32745)

  - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl. (CVE-2022-32746)

  - Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability (CVE-2022-37966)

  - Windows Kerberos Elevation of Privilege Vulnerability (CVE-2022-37967)

  - Netlogon RPC Elevation of Privilege Vulnerability (CVE-2022-38023)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

  - Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov     8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable Samba Active Directory DCs will     issue rc4-hmac encrypted tickets despite the target server supporting better encryption (eg aes256-cts-     hmac-sha1-96). (CVE-2022-45141)

  - A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise     unprivileged users to delete this attribute from any object in the directory. (CVE-2023-0225)

  - The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP     filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a     Samba AD DC. (CVE-2023-0614)

  - The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new     or reset passwords over a signed-only connection. (CVE-2023-0922)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-2570 advisory.

    - Add support for MS-PAC extended KDC signature (CVE-2022-37967)
    - Fix integer overflows in PAC parsing (CVE-2022-42898)
    - Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
    - Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:2570 advisory.

  - Kerberos Security Feature Bypass Vulnerability (CVE-2020-17049)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2570 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    The following packages have been upgraded to a later upstream version: krb5 (1.20.1). (BZ#2016312)

    Security Fix(es):

    * Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-032 advisory.

    2024-02-15: CVE-2016-2124 was added to this advisory.

    2024-02-15: CVE-2021-44141 was added to this advisory.

    2024-02-15: CVE-2021-20316 was added to this advisory.

    2024-02-15: CVE-2020-17049 was added to this advisory.

    A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

    It was found that the Kerberos Key Distribution Center (KDC) delegation feature, Service for User (S4U),     did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service     principal allowed to delegate could use this flaw to impersonate a non-forwardable user. (CVE-2020-17049)

    A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share.

    A fix for CVE-2021-20316 will not be provided for Amazon Linux 1 and Amazon Linux 2. You can mitigate this     issue by disabling SMBv1.To do so, add server min protocol = SMB2 to the [global] section of     /etc/samba/smb.conf (CVE-2021-20316)

    All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to     allow a directory to be created in an area of the server file system not exported under the share     definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack     to succeed. (CVE-2021-43566)

    All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.

    A fix for CVE-2021-44141 for will not be provided for Amazon Linux 1 and Amazon Linux 2. You can mitigate     this issue by disabling SMBv1.To do so, add server min protocol = SMB2 to the [global] section of     /etc/samba/smb.conf (CVE-2021-44141)

    Samba AD users with permission to write to an account can impersonate arbitrary services (CVE-2022-0336)

    In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. (CVE-2022-1615)

    A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer). (CVE-2022-32742)

    Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit     unprivileged users to write it. (CVE-2022-32743)

    A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl. (CVE-2022-32746)

    A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

    Samba 4.17 introduced following symlinks in user space with the intent to properly check symlink targets     to stay within the share that was configured by the administrator. The check does not properly cover a     corner case, so that a user can create a symbolic link that will make smbd escape the configured share     path. (CVE-2022-3592)

    Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability. (CVE-2022-37966)

    Windows Kerberos Elevation of Privilege Vulnerability. (CVE-2022-37967)

    Netlogon RPC Elevation of Privilege Vulnerability. (CVE-2022-38023)

    Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets (CVE-2022-45141)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.10.16-20.62. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1642 advisory.

    It was found that the Kerberos Key Distribution Center (KDC) delegation feature, Service for User (S4U),     did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service     principal allowed to delegate could use this flaw to impersonate a non-forwardable user. (CVE-2020-17049)

    A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer). (CVE-2022-32742)

    A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By     encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling     full domain takeover. (CVE-2022-32744)

    A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP     add or modify the request, usually resulting in a segmentation fault. (CVE-2022-32745)

    A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl. (CVE-2022-32746)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote host is prior to 4.16.5-0. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-213 advisory.

  - A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a     service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the     vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that     is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by     changing how the KDC validates service tickets used with KCD. (CVE-2020-17049)

  - A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer). (CVE-2022-32742)

  - A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By     encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling     full domain takeover. (CVE-2022-32744)

  - A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP     add or modify the request, usually resulting in a segmentation fault. (CVE-2022-32745)

  - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl. (CVE-2022-32746)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Windows installation on the remote host is missing security update 4586781. It is, therefore,  affected by multiple vulnerabilities. Please review the vendor advisory for more details.

The Microsoft 4586830 Product is missing security updates.

  - Remote Desktop Protocol Server Information Disclosure Vulnerability (CVE-2020-16997)

  - DirectX Elevation of Privilege Vulnerability (CVE-2020-16998)

  - Windows WalletService Information Disclosure Vulnerability (CVE-2020-16999)

  - Remote Desktop Protocol Client Information Disclosure Vulnerability (CVE-2020-17000)

  - Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17014.
    (CVE-2020-17001)

  - Windows Graphics Component Information Disclosure Vulnerability (CVE-2020-17004)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033,     CVE-2020-17034, CVE-2020-17043, CVE-2020-17044. (CVE-2020-17055)

  - Windows Network File System Information Disclosure Vulnerability (CVE-2020-17056)

  - Windows Win32k Elevation of Privilege Vulnerability (CVE-2020-17057)

  - Windows GDI+ Remote Code Execution Vulnerability (CVE-2020-17068)

  - Windows NDIS Information Disclosure Vulnerability (CVE-2020-17069)

  - Windows Delivery Optimization Information Disclosure Vulnerability (CVE-2020-17071)

  - Windows USO Core Worker Elevation of Privilege Vulnerability (CVE-2020-17075)

  - Windows Kernel Local Elevation of Privilege Vulnerability (CVE-2020-17087)

  - Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVE-2020-17088)

  - Windows Camera Codec Information Disclosure Vulnerability (CVE-2020-17113)

  - Windows Spoofing Vulnerability (CVE-2020-1599)

  - Windows Error Reporting Elevation of Privilege Vulnerability (CVE-2020-17007)

  - Windows Port Class Library Elevation of Privilege Vulnerability (CVE-2020-17011)

  - Windows Print Spooler Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17001.
    (CVE-2020-17014)

  - Windows Client Side Rendering Print Provider Elevation of Privilege Vulnerability (CVE-2020-17024)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17026,     CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034,     CVE-2020-17043, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17025)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034,     CVE-2020-17043, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17026)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034,     CVE-2020-17043, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17027)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17027, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034,     CVE-2020-17043, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17028)

  - Windows Canonical Display Driver Information Disclosure Vulnerability (CVE-2020-17029)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17032, CVE-2020-17033, CVE-2020-17034,     CVE-2020-17043, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17031)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17033, CVE-2020-17034,     CVE-2020-17043, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17032)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17034,     CVE-2020-17043, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17033)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033,     CVE-2020-17043, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17034)

  - Windows Kernel Elevation of Privilege Vulnerability (CVE-2020-17035)

  - Windows Function Discovery SSDP Provider Information Disclosure Vulnerability (CVE-2020-17036)

  - Windows WalletService Elevation of Privilege Vulnerability (CVE-2020-17037)

  - Win32k Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17010. (CVE-2020-17038)

  - Windows Hyper-V Security Feature Bypass Vulnerability (CVE-2020-17040)

  - Windows Print Configuration Elevation of Privilege Vulnerability (CVE-2020-17041)

  - Windows Print Spooler Remote Code Execution Vulnerability (CVE-2020-17042)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033,     CVE-2020-17034, CVE-2020-17044, CVE-2020-17055. (CVE-2020-17043)

  - Windows Remote Access Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2020-17025,     CVE-2020-17026, CVE-2020-17027, CVE-2020-17028, CVE-2020-17031, CVE-2020-17032, CVE-2020-17033,     CVE-2020-17034, CVE-2020-17043, CVE-2020-17055. (CVE-2020-17044)

  - Windows KernelStream Information Disclosure Vulnerability (CVE-2020-17045)

  - Windows Error Reporting Denial of Service Vulnerability (CVE-2020-17046)

  - Windows Network File System Denial of Service Vulnerability (CVE-2020-17047)

  - Chakra Scripting Engine Memory Corruption Vulnerability This CVE ID is unique from CVE-2020-17054.
    (CVE-2020-17048)

  - Kerberos Security Feature Bypass Vulnerability (CVE-2020-17049)

  - Windows Network File System Remote Code Execution Vulnerability (CVE-2020-17051)

  - Scripting Engine Memory Corruption Vulnerability (CVE-2020-17052)

  - Chakra Scripting Engine Memory Corruption Vulnerability This CVE ID is unique from CVE-2020-17048.
    (CVE-2020-17054)

  - Microsoft Browser Memory Corruption Vulnerability (CVE-2020-17058)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211259	Fedora 37 : libldb / samba (2022-3fd94cef3e)	Nessus	Fedora Local Security Checks	high
199136	RHEL 7 : krb5 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196677	RHEL 7 : kerberos (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
189658	RHEL 8 : idm:DL1 (RHSA-2024:0137)	Nessus	Red Hat Local Security Checks	medium
188059	RHEL 8 : krb5 (RHSA-2024:0252)	Nessus	Red Hat Local Security Checks	medium
188035	Oracle Linux 8 : idm:DL1 (ELSA-2024-0143)	Nessus	Oracle Linux Local Security Checks	medium
188017	Rocky Linux 8 : idm:DL1 (RLSA-2024:0143)	Nessus	Rocky Linux Local Security Checks	medium
188006	AlmaLinux 8 : idm:DL1 (ALSA-2024:0143)	Nessus	Alma Linux Local Security Checks	medium
187884	RHEL 8 : idm:DL1 (RHSA-2024:0143)	Nessus	Red Hat Local Security Checks	medium
187880	RHEL 8 : idm:DL1 (RHSA-2024:0139)	Nessus	Red Hat Local Security Checks	medium
187876	CentOS 8 : idm:DL1 (CESA-2024:0143)	Nessus	CentOS Local Security Checks	medium
181514	GLSA-202309-06 : Samba: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
175707	Oracle Linux 9 : krb5 (ELSA-2023-2570)	Nessus	Oracle Linux Local Security Checks	medium
175606	AlmaLinux 9 : krb5 (ALSA-2023:2570)	Nessus	Alma Linux Local Security Checks	medium
175403	RHEL 9 : krb5 (RHSA-2023:2570)	Nessus	Red Hat Local Security Checks	medium
173148	Amazon Linux 2023 : libnetapi, libnetapi-devel, libsmbclient (ALAS2023-2023-032)	Nessus	Amazon Linux Local Security Checks	critical
168596	Amazon Linux AMI : samba (ALAS-2022-1642)	Nessus	Amazon Linux Local Security Checks	high
168577	Amazon Linux 2022 : samba (ALAS2022-2022-213)	Nessus	Amazon Linux Local Security Checks	high
142693	KB4586793: Windows 10 Version 1809 and Windows Server 2019 November 2020 Security Update	Nessus	Windows : Microsoft Bulletins	critical
142690	KB4586830: Windows 10 Version 1607 and Windows Server 2016 November 2020 Security Update	Nessus	Windows : Microsoft Bulletins	critical
142687	KB4586808: Windows Server 2012 November 2020 Security Update	Nessus	Windows : Microsoft Bulletins	critical
142686	KB4586823: Windows 8.1 and Windows Server 2012 R2 November 2020 Security Update	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2020-17049

medium

Tenable Plugins

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

critical

high

high

critical

critical

critical

critical