Detections
Analytics

Debian dla-3792 : ctdb - security update

medium Nessus Plugin ID 193744

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3792 advisory.

 - A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker. (CVE-2020-14318)

 - A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service. (CVE-2020-14323)

 - A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, will be restarted after a short delay, but it is easy for an authenticated non administrative attacker to crash it again as soon as it returns. The Samba DNS server itself will continue to operate, but many RPC services will not.
 (CVE-2020-14383)

 - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

 - A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer). (CVE-2022-32742)

 - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

 - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system acls = yes. The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions. (CVE-2023-4091)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the ctdb packages.

See Also

https://security-tracker.debian.org/tracker/source-package/samba

https://security-tracker.debian.org/tracker/CVE-2020-14318

https://security-tracker.debian.org/tracker/CVE-2020-14323

https://security-tracker.debian.org/tracker/CVE-2020-14383

https://security-tracker.debian.org/tracker/CVE-2022-2127

https://security-tracker.debian.org/tracker/CVE-2022-32742

https://security-tracker.debian.org/tracker/CVE-2022-3437

https://security-tracker.debian.org/tracker/CVE-2023-4091

https://packages.debian.org/source/buster/samba

Plugin Details

Severity: Medium

ID: 193744

File Name: debian_DLA-3792.nasl

Version: 1.1

Type: local

Agent: unix

Published: 4/23/2024

Updated: 6/18/2024

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2020-14318

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2023-4091

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libpam-winbind, p-cpe:/a:debian:debian_linux:python-samba, p-cpe:/a:debian:debian_linux:samba-dsdb-modules, p-cpe:/a:debian:debian_linux:ctdb, p-cpe:/a:debian:debian_linux:smbclient, p-cpe:/a:debian:debian_linux:winbind, p-cpe:/a:debian:debian_linux:libsmbclient, cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:samba-dev, p-cpe:/a:debian:debian_linux:samba-libs, p-cpe:/a:debian:debian_linux:samba, p-cpe:/a:debian:debian_linux:registry-tools, p-cpe:/a:debian:debian_linux:samba-common-bin, p-cpe:/a:debian:debian_linux:libwbclient-dev, p-cpe:/a:debian:debian_linux:samba-vfs-modules, p-cpe:/a:debian:debian_linux:samba-testsuite, p-cpe:/a:debian:debian_linux:libwbclient0, p-cpe:/a:debian:debian_linux:libsmbclient-dev, p-cpe:/a:debian:debian_linux:libnss-winbind, p-cpe:/a:debian:debian_linux:samba-common

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 4/22/2024

Vulnerability Publication Date: 10/29/2020

Reference Information

CVE: CVE-2020-14318, CVE-2020-14323, CVE-2020-14383, CVE-2022-2127, CVE-2022-32742, CVE-2022-3437, CVE-2023-4091

IAVA: 2020-A-0508-S, 2022-A-0299-S, 2022-A-0447-S, 2023-A-0376-S, 2023-A-0535