The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.

samba's make_connection_snum() handles certain input incorrectly, which may lead to disclosure of the root directory. CVE-2009-2813 has been assigned to this issue. Additionally an information disclosure vulnerability in mount.cifs has been fixed (CVE-2009-2948) as well as a DoS condition (CVE-2009-2906).

samba's make_connection_snum() handles certain input incorrectly, which may lead to disclosure of the root directory. CVE-2009-2813 has been assigned to this issue. Additionally an information disclosure vulnerability in mount.cifs has been fixed (CVE-2009-2948) as well as a DoS condition. (CVE-2009-2906)

Updated samba packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A denial of service flaw was found in the Samba smbd daemon. An authenticated, remote user could send a specially crafted response that would cause an smbd child process to enter an infinite loop. An authenticated, remote user could use this flaw to exhaust system resources by opening multiple CIFS sessions. (CVE-2009-2906)

This update also fixes the following bug :

* the RHSA-2007:0354 update added code to escape input passed to scripts that are run by Samba. This code was missing 'c' from the list of valid characters, causing it to be escaped. With this update, the previous patch has been updated to include 'c' in the list of valid characters. (BZ#242754)

Users of Samba should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the smb service will be restarted automatically.

From Red Hat Security Advisory 2009:1528 :

Updated samba packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Samba is a suite of programs used by machines to share files, printers, and other information.

A denial of service flaw was found in the Samba smbd daemon. An authenticated, remote user could send a specially crafted response that would cause an smbd child process to enter an infinite loop. An authenticated, remote user could use this flaw to exhaust system resources by opening multiple CIFS sessions. (CVE-2009-2906)

This update also fixes the following bug :

* the RHSA-2007:0354 update added code to escape input passed to scripts that are run by Samba. This code was missing 'c' from the list of valid characters, causing it to be escaped. With this update, the previous patch has been updated to include 'c' in the list of valid characters. (BZ#242754)

Users of Samba should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the smb service will be restarted automatically.

J. David Hester discovered that Samba incorrectly handled users that lack home directories when the automated [homes] share is enabled. An authenticated user could connect to that share name and gain access to the whole filesystem. (CVE-2009-2813)

Tim Prouty discovered that the smbd daemon in Samba incorrectly handled certain unexpected network replies. A remote attacker could send malicious replies to the server and cause smbd to use all available CPU, leading to a denial of service. (CVE-2009-2906)

Ronald Volgers discovered that the mount.cifs utility, when installed as a setuid program, would not verify user permissions before opening a credentials file. A local user could exploit this to use or read the contents of unauthorized credential files. (CVE-2009-2948)

Reinhard Nissl discovered that the smbclient utility contained format string vulnerabilities in its file name handling. Because of security features in Ubuntu, exploitation of this vulnerability is limited. If a user or automated system were tricked into processing a specially crafted file name, smbclient could be made to crash, possibly leading to a denial of service. This only affected Ubuntu 8.10.
(CVE-2009-1886)

Jeremy Allison discovered that the smbd daemon in Samba incorrectly handled permissions to modify access control lists when dos filemode is enabled. A remote attacker could exploit this to modify access control lists. This only affected Ubuntu 8.10 and Ubuntu 9.04.
(CVE-2009-1886).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service flaw was found in the Samba smbd daemon. An authenticated, remote user could send a specially crafted response that would cause an smbd child process to enter an infinite loop. An authenticated, remote user could use this flaw to exhaust system resources by opening multiple CIFS sessions. (CVE-2009-2906)

An uninitialized data access flaw was discovered in the smbd daemon when using the non-default 'dos filemode' configuration option in 'smb.conf'. An authenticated, remote user with write access to a file could possibly use this flaw to change an access control list for that file, even when such access should have been denied. (CVE-2009-1888)

A flaw was discovered in the way Samba handled users without a home directory set in the back-end password database (e.g. '/etc/passwd').
If a share for the home directory of such a user was created (e.g.
using the automated '[homes]' share), any user able to access that share could see the whole file system, possibly bypassing intended access restrictions.(CVE-2009-2813)

The mount.cifs program printed CIFS passwords as part of its debug output when running in verbose mode. When mount.cifs had the setuid bit set, a local, unprivileged user could use this flaw to disclose passwords from a file that would otherwise be inaccessible to that user. Note: mount.cifs from the samba packages distributed by Red Hat does not have the setuid bit set. This flaw only affected systems where the setuid bit was manually set by an administrator.
(CVE-2009-2948) This update also fixes the following bug for SL3 :

  - an earlier update added code to escape input passed to     scripts that are run by Samba. This code was missing 'c'     from the list of valid characters, causing it to be     escaped. With this update, the previous patch has been     updated to include 'c' in the list of valid characters.
    (BZ#242754)

After installing this update, the smb service will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201206-22 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with root       privileges, cause a Denial of Service condition, take ownership of shared       files, or bypass file permissions. Furthermore, a local attacker may be       able to cause a Denial of Service condition or obtain sensitive       information in a Samba credentials file.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

According to its banner, the version of Samba server on the remote host is potentially affected by multiple vulnerabilities : 

  - If a user in '/etc/passwd' is misconfigured to have an empty home directory then connecting to the home share of this user will use the root of the filesystem as the home directory. (CVE-2009-2813)

  - Specially crafted SMB requests on authenticated SMB connections can send smbd into a 100% loop, causing a denial of service. (CVE-2009-2906)

  - When 'mount.cifs' is installed as a setuid program, a user can pass it a credential or password path to which he or she does not have access and then use the '--verbose' option to view the first line of that file. (CVE-2009-2948)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

ID	名稱	產品	系列	已發布	已更新	嚴重性
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
54873	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / current : samba (SSA:2009-276-01)	Nessus	Slackware Local Security Checks	2011/5/28	2021/1/14	medium
42228	openSUSE Security Update : cifs-mount (cifs-mount-1354)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	medium
42231	openSUSE Security Update : cifs-mount (cifs-mount-1354)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	medium
42233	SuSE 11 Security Update : Samba (SAT Patch Number 1352)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	medium
42285	RHEL 3 : samba (RHSA-2009:1528)	Nessus	Red Hat Local Security Checks	2009/10/28	2021/1/14	medium
67946	Oracle Linux 3 : samba (ELSA-2009-1528)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
41968	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : samba vulnerabilities (USN-839-1)	Nessus	Ubuntu Local Security Checks	2009/10/2	2021/1/19	high
60684	Scientific Linux Security Update : samba on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
49833	SuSE 10 Security Update : Samba (ZYPP Patch Number 6551)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	medium
59675	GLSA-201206-22 : Samba: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/6/25	2021/1/6	critical
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
5194	Samba < 3.0.37 / 3.2.15 / 3.3.8 / 3.4.2 Multiple Vulnerabilities	Nessus Network Monitor	Samba	2009/10/2	2019/3/6	medium
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2010/3/30	2019/3/6	critical

偵測

搜尋 Plugin

critical

critical

medium

medium

medium

medium

medium

medium

high

medium

medium

critical

critical

medium

critical