The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1585 advisory.

  - A flaw was found in the way samba handled file and directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory information which otherwise would be unavailable to     the attacker. (CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of     service. (CVE-2020-14323)

  - An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'. (CVE-2020-1472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : ctdb (ALAS-2021-1585)

medium Nessus Plugin ID 144800

Version 1.9

Version 1.8

Version 1.7

Version 1.9 Jan 30, 2024, 3:19 PM CVSS metrics ("CVSSv3 score" set to 5.5. "CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Plugin Feed: 202401301519
Version 1.8 May 24, 2023, 12:08 AM CEA reference Plugin Feed: 202305240008
Version 1.7 Dec 7, 2022, 4:47 PM Reference Plugin Feed: 202212071647