The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0283-1 advisory.

  - A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be     ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory,     resulting in a crash. The highest threat from this vulnerability is to system availability.
    (CVE-2020-27840)

  - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to     an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The     highest threat from this vulnerability is to system availability. (CVE-2021-20277)

  - A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated     attacker with permissions to read or modify share metadata, to perform this operation outside of the     share. (CVE-2021-20316)

  - ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before     1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon     crash. This occurs because a return value is not properly managed in a certain situation. (CVE-2021-36222)

  - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to     allow a directory to be created in an area of the server file system not exported under the share     definition. Note that SMB1 has to be enabled, or the share also available via NFS in order for this attack     to succeed. (CVE-2021-43566)

  - All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to     determine if a file or directory exists in an area of the server file system not exported under the share     definition. SMB1 with unix extensions has to be enabled in order for this attack to succeed.
    (CVE-2021-44141)

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

  - The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that     SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an     account modification re-adds an SPN that was previously present on that account, such as one added when a     computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to     perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an     attacker who can intercept traffic can impersonate existing services, resulting in a loss of     confidentiality and integrity. (CVE-2022-0336)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2022:0283-1)

high Nessus Plugin ID 157307

Version 1.11

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.11 Nov 2, 2023, 4:31 AM IAVM reference Plugin Feed: 202311020431
Version 1.10 Jul 14, 2023, 5:13 AM Exploit attributes ("Exploited by malware" set to "True") Plugin metadata Plugin Feed: 202307140513
Version 1.9 Jul 12, 2023, 5:37 PM Detection Plugin Feed: 202307121737
Version 1.8 Mar 10, 2023, 5:10 PM Logic Changes (Added support for additional SUSE Platforms) Plugin Feed: 202303101710
Version 1.7 Feb 3, 2023, 4:05 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") CVSSv3 score source (set to "CVE-2022-0336") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:H/RL:O/RC:C") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:H/RL:OF/RC:C") Exploit attributes ("Exploited by malware" set to "True") Exploit attributes ("Exploit available" set to "True") Plugin Feed: 202302031605
Version 1.6 Nov 8, 2022, 10:01 AM IAVM reference Plugin Feed: 202211081001