The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4046-1 advisory.

  - The SMB 1/2/3 protocols allow clients to connect to named pipes via the IPC$ (Inter-Process Communication)     share for the process of inter-process communication between SMB clients and servers. Since Samba 4.16.0,     Samba internally connects client pipe names to unix domain sockets within a private directory, allowing     clients to connect to services listening on those sockets. This is usually used to connect SMB clients to     remote proceedure call (RPC) services, such as SAMR LSA, or SPOOLSS, which Samba starts on demand.
    However, insufficient sanitization was done on the incoming client pipe name, meaning that a client     sending a pipe name containing unix directory traversal characters (../) could cause Samba to connect to     unix domain sockets outside of the private directory meant to restrict the services a client could connect     to. Samba connects to the unix domain sockets as root, meaning if a client could send a pipe name that     resolved to an external service using an existing unix domain socket, the client would be able to connect     to it without filesystem permissions restricting access. Depending on the service the client can connect     to, the client may be able to trigger adverse events such as denial of service, crashing the service, or     potentially compromising it. There are no current known exploits for this bug. (CVE-2023-3961)

  - The vulnerability exists due to an error in the way SMB protocol implementation in Samba handles file     operations. A remote user can request read-only access to files and then truncate them to 0 bytes by     opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf     setting acl_xattr:ignore system acls = yes. (CVE-2023-4091)

  - The vulnerability exists due to a design error in Samba's implementation of the DirSync control, which can     allow replication of critical domain passwords and secrets by Active Directory accounts authorized to do     some replication, but not to replicate sensitive attributes. A remote user can obtain sensitive     information from the AD DC and compromise the Active Directory. (CVE-2023-4154)

  - The vulnerability exists due to inclusion of the rpcecho server into production build, which can call     sleep() on AD DC. A remote user can request the server block using the rpcecho server and perform a     denial of service (DoS) attack. (CVE-2023-42669)

  - The vulnerability exists due to improper management of internal resources within the application when     Samba RPC server is under load, which can lead to incorrect start of servers not built for the AD DC. A     remote user can cause a high load to Samba RPC server and perform a denial of service (DoS) attack.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : samba (SUSE-SU-2023:4046-1)

critical Nessus Plugin ID 183005

Version 1.2