The version of samba installed on the remote host is prior to 4.18.8 / 4.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-284-03 advisory.

  - The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ (Inter-Process Communication)     share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0,     Samba internally connects client pipe names to unix domain sockets within a private directory, allowing     clients to connect to services listening on those sockets. This is usually used to connect SMB clients to     remote proceedure call (RPC) services, such as SAMR LSA, or SPOOLSS, which Samba starts on demand.
    However, insufficient sanitization was done on the incoming client pipe name, meaning that a client     sending a pipe name containing unix directory traversal characters (../) could cause Samba to connect to     unix domain sockets outside of the private directory meant to restrict the services a client could connect     to. Samba connects to the unix domain sockets as root, meaning if a client could send a pipe name that     resolved to an external service using an existing unix domain socket, the client would be able to connect     to it without filesystem permissions restricting access. Depending on the service the client can connect     to, the client may be able to trigger adverse events such as denial of service, crashing the service, or     potentially compromising it. There are no current known exploits for this bug. (CVE-2023-3961)

  - The SMB protocol allows opening files where the client requests read-only access, but then implicitly     truncating the opened file if the client specifies a separate OVERWRITE create disposition. This operation     requires write access to the file, and in the default Samba configuration the operating system kernel will     deny access to open a read-only file for read/write (which the truncate operation requires). However, when     Samba has been configured to ignore kernel file system permissions, Samba will truncate a file when the     underlying operating system kernel would deny the operation. Affected Samba configurations are the ones     where kernel file-system permission checks are bypassed, relying on Samba's own permission enforcement.
    The error is that this check is done against the client request for read-only access, and not the     implicitly requested read-write (for truncate) one. The widely used Samba VFS module acl_xattr when     configured with the module configuration parameter acl_xattr:ignore system acls = yes is the only     upstream Samba module that allows this behavior and is the only known method of reproducing this security     flaw. If (as is the default) the module configuration parameter acl_xattr:ignore system acls=no, then     the Samba server is not vulnerable to this attack. (CVE-2023-4091)

  - In normal operation, passwords and (most) secrets are never disclosed over LDAP in Active Directory.
    However, due to a design flaw in Samba's implementation of the DirSync control, Active Directory accounts     authorized to do some replication, but not to replicate sensitive attributes, can instead replicate     critical domain passwords and secrets. In a default installation, this means that RODC DC accounts (which     should only be permitted to replicate some passwords) can instead obtain all domain secrets, including the     core AD secret: the krbtgt password. RODCs are given this permission as part of their installation for DRS     replication. This vulnerability removes the RODC / DC distinction. Secondly, and just as problematically,     the access check for this functionality did not account for error conditions - errors like out of memory     were regarded as success. This is sometimes described as fail open. In these error conditions, some of     which (eg out of memory) may be influenced by a low-privileged attacker, access to the secret attributes     could be obtained! (CVE-2023-4154)

  - Samba developers have built a non-Windows RPC server known as rpcecho to test elements of the Samba     DCE/RPC stack under their full control. One RPC function provided by rpcecho can block, essentially     indefinitely, and because the rpcecho service is provided from the main RPC task, which has only one     worker, this denies essentially all service on the AD DC. To address this problem, the rpcecho server is     removed from our production binaries and is restricted to selftest builds only. (CVE-2023-42669)

  - Samba as an Active Directory DC operates RPC services from two distinct parts of the codebase. Those     services focused on the AD DC are started in the main samba process, while services focused on the     fileserver and NT4-like DC are started from the new samba-dcerpcd, which is launched on-demand from the     fileserver (smbd) tasks. When starting, samba-dcerpcd must first confirm which services not to provide, so     as to avoid duplicate listeners. The issue in this advisory is that, when Samba's RPC server is under     load, or otherwise not responding, the servers NOT built for the AD DC (eg build instead for the     NT4-emulation classic DCs) can be incorrectly started, and compete to listen on the same unix domain     sockets. This then results in some queries being answered by the AD DC, and some not. This has been seen     in production at multiple sites, as The procedure number is out of range when starting Active Directory     Users and Computers tool, however it can also be triggered maliciously, to prevent service on the AD DC.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Slackware Linux 15.0 / current samba Multiple Vulnerabilities (SSA:2023-284-03)

critical Nessus Plugin ID 182877

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.5 Nov 14, 2023, 2:07 PM CVSS metrics ("CVSSv2 score" set to 10.0. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C". "CVSSv3 score" set to 9.8. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv3 score source (changed from "CVE-2023-4154" to none) CVSSv3 severity (based on None, severity increased from "Medium" to "High") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202311141407
Version 1.4 Nov 8, 2023, 3:41 PM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N") CVSSv3 score source (changed from "CVE-2023-42669" to "CVE-2023-4154") Plugin Feed: 202311081541
Version 1.3 Nov 7, 2023, 3:08 PM CVSSv3 score source (set to "CVE-2023-42669") CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H") Plugin Feed: 202311071508
Version 1.2 Nov 6, 2023, 2:53 PM CVSSv2 severity (based on CVE-2023-3961, severity increased from "Medium" to "High") CVSS metrics ("CVSSv2 score" set to 7.8. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N". "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N") CVSSv2 score source (changed from "CVE-2023-4091" to "CVE-2023-3961") Plugin Feed: 202311061453
Version 1.1 Oct 13, 2023, 2:22 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202310131422
Version 1.1 Nov 6, 2023, 1:01 PM CVSS metrics ("CVSSv2 score" set to 7.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N") CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N") CVSSv2 score source (changed from "CVE-2023-4091" to "CVE-2023-3961") CVSSv2 severity (based on CVE-2023-3961, severity increased from "Medium" to "High") Plugin Feed: 202311061301
Version 1.0 Oct 11, 2023, 12:04 PM New Plugin Feed: 202310111204