According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC     (read-only domain controller). This would allow an RODC to print administrator tickets. (CVE-2020-25718)

  - A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise. (CVE-2020-25719)

  - Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored     data. An attacker could use this flaw to cause total domain compromise. (CVE-2020-25722)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC     (read-only domain controller). This would allow an RODC to print administrator tickets. (CVE-2020-25718)

  - A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise. (CVE-2020-25719)

  - Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored     data. An attacker could use this flaw to cause total domain compromise. (CVE-2020-25722)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC     (read-only domain controller). This would allow an RODC to print administrator tickets. (CVE-2020-25718)

  - A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise. (CVE-2020-25719)

  - Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now     provides a way for Linux applications to obtain a reliable SID (and samAccountName) in issued tickets.
    (CVE-2020-25721)

  - Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored     data. An attacker could use this flaw to cause total domain compromise. (CVE-2020-25722)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

  - In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections     via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb     database. However while the database was correctly shared, the user credentials state was only pointed at,     and when one connection within that association group ended, the database would be left pointing at an     invalid 'struct session_info'. The most likely outcome here is a crash, but it is possible that the use-     after-free could instead allow different user state to be pointed at and this might allow more privileged     access. (CVE-2021-3738)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5015 advisory.

    Andrew Bartlett discovered that Samba, a SMB/CIFS file, print, and login server for Unix, may map domain     users to local users in an undesired way. This could allow a user in an AD domain to potentially become     root on domain members. A new parameter min domain uid (default 1000) has been added to specify the     minimum uid allowed when mapping a local account to a domain account. Further details and workarounds can     be found in the upstream advisory https://www.samba.org/samba/security/CVE-2020-25717.html For the     oldstable distribution (buster), this problem has been fixed in version 2:4.9.5+dfsg-5+deb10u2.
    Additionally the update mitigates CVE-2020-25722. Unfortunately the changes required to fix additional     CVEs affecting Samba as an AD-compatible domain controller are too invasive to be backported. Thus users     using Samba as an AD-compatible domain controller are encouraged to migrate to Debian bullseye. From this     point onwards AD domain controller setups are no longer supported in Debian oldstable. We recommend that     you upgrade your samba packages. For the detailed security status of samba please refer to its security     tracker page at: https://security-tracker.debian.org/tracker/samba

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
158380	EulerOS 2.0 SP10 : samba (EulerOS-SA-2022-1246)	Nessus	Huawei Local Security Checks	2022/2/25	2022/11/8	high
158522	EulerOS 2.0 SP9 : samba (EulerOS-SA-2022-1311)	Nessus	Huawei Local Security Checks	2022/3/2	2022/11/8	high
159868	EulerOS Virtualization 2.10.0 : samba (EulerOS-SA-2022-1413)	Nessus	Huawei Local Security Checks	2022/4/18	2022/11/8	high
214602	Debian DSA-5015-1 : samba - security update	Nessus	Debian Local Security Checks	2025/1/24	2025/1/24	high

偵測

搜尋 Plugin

high

high

high

high