Detections
Analytics
Samba 3.x < 3.6.22 / 4.0.x < 4.0.13 / 4.1.x < 4.1.3 Multiple Vulnerabilities
high Nessus Plugin ID 71377
Language:
Synopsis
The remote Samba server is affected by multiple vulnerabilities.Description
According to its banner, the version of Samba running on the remote host is 3.3.x equal or later than 3.3.10, 3.4.x, 3.5.x, 3.6.x prior to 3.6.22, 4.0.x prior to 4.0.13 or 4.1.x prior to 4.1.3. It is, therefore, potentially affected by multiple vulnerabilities :- A security bypass vulnerability exists in the 'winbind_name_list_to_sid_string_list()' function of the 'nsswitch/pam_winbind.c' source file. Exploitation could allow a malicious, authenticated user access to the 'pam_winbind' configuration file. (CVE-2012-6150)
- A buffer overflow exists in the 'dcerpc_read_ncacn_packet_done' function of the 'librpc/rpc/dcerpc_util.c' source file that could allow remote AD domain controllers to execute arbitrary code on the remote host via DCE-RPC packet with an invalid fragment length. (CVE-2013-4408)
Note that Nessus has relied only on the self-reported version number and has not actually tried to exploit this issue or determine if the associated patch has been applied.
Solution
Upgrade to version 3.6.22 / 4.0.13 / 4.1.3 or later or refer to the vendor for a patch or workaround.See Also
https://www.samba.org/samba/security/CVE-2012-6150.html
https://www.samba.org/samba/security/CVE-2013-4408.html
Plugin Details
Severity: High
ID: 71377
File Name: samba_4_1_3.nasl
Version: 1.9
Type: remote
Family: Misc.
Published: 12/12/2013
Updated: 9/17/2018
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 8.3
Temporal Score: 6.1
Vector: CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2013-4408
Vulnerability Information
CPE: cpe:/a:samba:samba
Required KB Items: SMB/NativeLanManager, SMB/samba, Settings/ParanoidReport
Exploit Ease: No known exploits are available
Patch Publication Date: 12/9/2013
Vulnerability Publication Date: 6/12/2012
Reference Information
CVE: CVE-2012-6150, CVE-2013-4408