Samba 4.4.x < 4.4.15 / 4.5.x < 4.5.12 / 4.6.x < 4.6.6 KDC-REP Service Name Validation (Orpheus' Lyre)

high Nessus Plugin ID 101773

Language:

Synopsis

The remote Samba server is affected by a service impersonation vulnerability.

Description

The version of Samba running on the remote host is 4.4.x prior to 4.4.15, 4.5.x prior to 4.5.12, or 4.6.x prior to 4.6.6. It is, therefore, affected by a logic flaw in the Heimdal implementation of Kerberos, specifically within the _krb5_extract_ticket() function within lib/krb5/ticket.c, due to the unsafe use of cleartext metadata from an unauthenticated ticket instead of the encrypted version stored in the Key Distribution Center (KDC) response. A man-in-the-middle attacker can exploit this issue to impersonate Kerberos services. This can potentially result in a privilege escalation or the theft of credentials. Note that Samba versions built against MIT Kerberos are not impacted by this issue.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Samba version 4.4.15 / 4.5.12 / 4.6.6 or later.

Alternatively, if you are not running Samba as an Active Directory domain controller, as a workaround, you can rebuild Samba using the following command : ./configure --with-system-mitkrb5.

Plugin Details

Severity: High

ID: 101773

File Name: samba_4_6_6.nasl

Version: 1.7

Type: remote

Family: Misc.

Published: 7/17/2017

Updated: 11/12/2019

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-11103

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:samba:samba

Required KB Items: Settings/ParanoidReport, SMB/samba, SMB/NativeLanManager

Exploit Ease: No known exploits are available

Patch Publication Date: 7/12/2017

Vulnerability Publication Date: 7/10/2017

Reference Information

CVE: CVE-2017-11103

BID: 99551

Detections

Analytics