The remote host is affected by the vulnerability described in GLSA-201805-07 (Samba: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Samba. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code, cause a Denial       of Service condition, conduct a man-in-the-middle attack, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Various vulnerabilities were discovered in Samba, SMB/CIFS file, print, and login server/client for Unix

CVE-2017-9461

smbd in Samba had a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.

CVE-2018-1050

Samba was vulnerable to a denial of service attack when the RPC spoolss service was configured to be run as an external daemon.
Missing input sanitization checks on some of the input parameters to spoolss RPC calls could have caused the print spooler service to crash.

CVE-2018-1057

On a Samba 4 AD DC the LDAP server of Samba incorrectly validated permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Thanks to the Ubuntu security team for having backported the rather invasive changeset to Samba in Ubuntu 14.04 (which we could use to patch Samba in Debian jessie LTS).

CVE-2019-3880

A flaw was found in the way Samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could have used this flaw to create a new registry hive file anywhere they had unix permissions which could have lead to creation of a new file in the Samba share.

For Debian 8 'Jessie', these problems have been fixed in version 2:4.2.14+dfsg-0+deb8u12.

We recommend that you upgrade your samba packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2018-1050     It was discovered that Samba is prone to a denial of     service attack when the RPC spoolss service is     configured to be run as an external daemon.

    https://www.samba.org/samba/security/CVE-2018-1050.html

  - CVE-2018-1057     Bjoern Baumbach from Sernet discovered that on Samba 4     AD DC the LDAP server incorrectly validates permissions     to modify passwords over LDAP allowing authenticated     users to change any other users passwords, including     administrative users.

    https://www.samba.org/samba/security/CVE-2018-1057.html

    https://wiki.samba.org/index.php/CVE-2018-1057

Security fix for CVE-2018-1050 CVE-2018-1057

----

Update to Samba 4.6.13

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1613 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 9.2. It addresses 88 CVEs:
    CVE-2018-1050, CVE-2020-10760, CVE-2013-4475, CVE-2020-10730, CVE-2018-16857, and 83 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1637 advisory.

    This advisory aggregates security fixes for the samba SRPM in CIQ LTS 9.6. It addresses 97 CVEs:
    CVE-2018-1050, CVE-2020-10760, CVE-2013-4475, CVE-2020-10730, CVE-2018-16857, and 92 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
109974	GLSA-201805-07 : Samba: Multiple vulnerabilities (SambaCry)	Nessus	Gentoo Local Security Checks	2018/5/23	2023/3/31	critical
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
123959	Debian DLA-1754-1 : samba security update	Nessus	Debian Local Security Checks	2019/4/10	2024/6/4	high
108304	Debian DSA-4135-1 : samba - security update	Nessus	Debian Local Security Checks	2018/3/14	2025/2/4	high
108501	Fedora 26 : 2:samba (2018-7d0acd608b)	Nessus	Fedora Local Security Checks	2018/3/21	2024/12/19	high
364622	Rocky Linux 9.2 [CIQ] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc Multiple Vulnerabilities (ciqsa-2026_1613)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/13	critical
364609	Rocky Linux 9.6 [CIQ] Security Update: ldb-tools / libldb / libldb-devel / libnetapi / libnetapi-devel / etc Multiple Vulnerabilities (ciqsa-2026_1637)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/13	critical

偵測

搜尋 Plugin

critical

critical

high

high

high

critical

critical