Synopsis
The remote SUSE host is missing one or more security updates.
Description
The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4046-1 advisory.
- The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ (Inter-Process Communication) share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0, Samba internally connects client pipe names to unix domain sockets within a private directory, allowing clients to connect to services listening on those sockets. This is usually used to connect SMB clients to remote proceedure call (RPC) services, such as SAMR LSA, or SPOOLSS, which Samba starts on demand.
However, insufficient sanitization was done on the incoming client pipe name, meaning that a client sending a pipe name containing unix directory traversal characters (../) could cause Samba to connect to unix domain sockets outside of the private directory meant to restrict the services a client could connect to. Samba connects to the unix domain sockets as root, meaning if a client could send a pipe name that resolved to an external service using an existing unix domain socket, the client would be able to connect to it without filesystem permissions restricting access. Depending on the service the client can connect to, the client may be able to trigger adverse events such as denial of service, crashing the service, or potentially compromising it. There are no current known exploits for this bug. (CVE-2023-3961)
- The vulnerability exists due to an error in the way SMB protocol implementation in Samba handles file operations. A remote user can request read-only access to files and then truncate them to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting acl_xattr:ignore system acls = yes. (CVE-2023-4091)
- The vulnerability exists due to a design error in Samba's implementation of the DirSync control, which can allow replication of critical domain passwords and secrets by Active Directory accounts authorized to do some replication, but not to replicate sensitive attributes. A remote user can obtain sensitive information from the AD DC and compromise the Active Directory. (CVE-2023-4154)
- The vulnerability exists due to inclusion of the rpcecho server into production build, which can call sleep() on AD DC. A remote user can request the server block using the rpcecho server and perform a denial of service (DoS) attack. (CVE-2023-42669)
- The vulnerability exists due to improper management of internal resources within the application when Samba RPC server is under load, which can lead to incorrect start of servers not built for the AD DC. A remote user can cause a high load to Samba RPC server and perform a denial of service (DoS) attack.
(CVE-2023-42670)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.
Plugin Details
File Name: suse_SU-2023-4046-1.nasl
Agent: unix
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:novell:suse_linux:ctdb, p-cpe:/a:novell:suse_linux:libsamba-policy-devel, p-cpe:/a:novell:suse_linux:libsamba-policy-python3-devel, p-cpe:/a:novell:suse_linux:libsamba-policy0-python3, p-cpe:/a:novell:suse_linux:samba, p-cpe:/a:novell:suse_linux:samba-ceph, p-cpe:/a:novell:suse_linux:samba-client, p-cpe:/a:novell:suse_linux:samba-client-libs, p-cpe:/a:novell:suse_linux:samba-client-libs-32bit, p-cpe:/a:novell:suse_linux:samba-devel, p-cpe:/a:novell:suse_linux:samba-gpupdate, p-cpe:/a:novell:suse_linux:samba-ldb-ldap, p-cpe:/a:novell:suse_linux:samba-libs, p-cpe:/a:novell:suse_linux:samba-libs-32bit, p-cpe:/a:novell:suse_linux:samba-libs-python3, p-cpe:/a:novell:suse_linux:samba-python3, p-cpe:/a:novell:suse_linux:samba-tool, p-cpe:/a:novell:suse_linux:samba-winbind, p-cpe:/a:novell:suse_linux:samba-winbind-libs, p-cpe:/a:novell:suse_linux:samba-winbind-libs-32bit, cpe:/o:novell:suse_linux:15
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Ease: Exploits are available
Patch Publication Date: 10/11/2023
Vulnerability Publication Date: 10/10/2023