Detections
Analytics
Samba 4.3.x < 4.3.13 / 4.4.x < 4.4.8 / 4.5.x < 4.5.3 Multiple Vulnerabilities
high Nessus Plugin ID 96142
Language:
Synopsis
The remote Samba server is affected by multiple vulnerabilities.Description
The version of Samba running on the remote host is 4.3.x prior to 4.3.13, 4.4.x prior to 4.4.8, or 4.5.x prior to 4.5.3. It is, therefore, affected by multiple vulnerabilities :- An overflow condition exists in the ndr_pull_dnsp_name() function in ndr_dnsp.c that is triggered when handling 'dnsRecord' attributes of DNS objects. An authenticated, remote attacker can exploit this, via a specially crafted request, to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-2123)
- A flaw exists in the client code when performing Kerberos authentication due to always requesting a forwardable Kerberos ticket. An adjacent attacker can exploit this to cause a service accepting the AP-REQ from the client to perform the same actions as the client within the Kerberos TGT, allowing the attacker to impersonate an authenticated user or service.
(CVE-2016-2125)
- A denial of service vulnerability exists in the check_pac_checksum() function in kerberos_pac.c due to improper handling of the arcfour-hmac-md5 PAC (Privilege Attribute Certificate) checksum. An authenticated, remote attacker can exploit this to corrupt memory, resulting in a crash of the winbindd process. (CVE-2016-2126)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Samba version 4.3.13 / 4.4.8 / 4.5.3 or later.Alternatively, apply the vendor-supplied security patch referenced in the advisory.
See Also
https://www.samba.org/samba/security/CVE-2016-2123.html
https://www.samba.org/samba/security/CVE-2016-2125.html
https://www.samba.org/samba/security/CVE-2016-2126.html
https://www.samba.org/samba/history/samba-4.3.13.html
Plugin Details
Severity: High
ID: 96142
File Name: samba_4_5_3.nasl
Version: 1.7
Type: remote
Family: Misc.
Published: 12/27/2016
Updated: 11/13/2019
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 4.8
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2016-2123
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:samba:samba
Required KB Items: Settings/ParanoidReport, SMB/samba, SMB/NativeLanManager
Exploit Ease: No known exploits are available
Patch Publication Date: 12/19/2016
Vulnerability Publication Date: 12/19/2016