Samba 4.16 < 4.17.12 / 4.18.x < 4.18.8 / 4.19.x < 4.19.1 Multiple Vulnerabilities

critical Nessus Plugin ID 183022

Language:

Synopsis

The remote Samba server is potentially affected by multiple vulnerabilities.

Description

The version of Samba running on the remote host is potentially affected by multiple vulnerabilities, as follows:

- Insufficient sanitisation of incoming client pipe names leading to directory traversal outside of the private directory meant to restrict the services that clients could connect to. Depending on the service the client can connect to, the client may be able to trigger adverse events such as denial of service, crashing the service, or potentially compromising it. (CVE-2023-3961)

- When Samba's RPC server is under load, or otherwise not responding, the servers NOT built for the AD DC can be incorrectly started, and compete to listen on the same unix domain sockets. This then results in some queries being answered by the AD DC, and some not. This issue can be triggered maliciously, to prevent service on the AD DC. (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Samba version 4.17.12, 4.18.8, or 4.19.1.

Plugin Details

Severity: Critical

ID: 183022

File Name: samba_4_19_1.nasl

Version: 1.3

Type: remote

Family: Misc.

Published: 10/13/2023

Updated: 11/14/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-3961

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:samba:samba

Required KB Items: SMB/samba, SMB/NativeLanManager

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/10/2023

Vulnerability Publication Date: 10/10/2023

Reference Information

CVE: CVE-2023-3961, CVE-2023-42670

IAVA: 2023-A-0535

Detections

Analytics