The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4046-1 advisory.

    - CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. (bsc#1215904)
    - CVE-2023-42669: Fixed a bug in 'rpcecho' development server which allows Denial of Service via sleep()     call on AD DC. (bsc#1215905)
    - CVE-2023-42670: Fixed the procedure number which was out of range when starting Active Directory Users     and Computers. (bsc#1215906)
    - CVE-2023-3961: Fixed an unsanitized client pipe name passed to local_np_connect(). (bsc#1215907)
    - CVE-2023-4154: Fixed a bug in dirsync which allows SYSTEM access with only 'GUID_DRS_GET_CHANGES' right.
    (bsc#1215908)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4096-1 advisory.

    - CVE-2023-4091: Fixed a bug where a client can truncate file with read-only permissions. (bsc#1215904)
    - CVE-2023-42669: Fixed a bug in 'rpcecho' development server which allows Denial of Service via sleep()     call on AD DC. (bso#1215905)
    - CVE-2023-4154: Fixed a bug in dirsync which allows SYSTEM access with only 'GUID_DRS_GET_CHANGES' right.
    (bsc#1215908)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202402-28 (Samba: Multiple Vulnerabilities)

  - An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control     checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of     deleted objects in the LDAP store. (CVE-2018-14628)

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not     enforced if an admin configured server signing = required or for SMB2 connections to Domain Controllers     where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-     the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and     server, affecting the integrity of the data. (CVE-2023-3347)

  - A path traversal vulnerability was identified in Samba when processing client pipe names connecting to     Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients     to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand.
    However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe     name containing Unix directory traversal characters (../). This could result in SMB clients connecting as     root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe     name resolving to an external service using an existing Unix domain socket, it could potentially lead to     unauthorized access to the service and consequential adverse events, including compromise or service     crashes. (CVE-2023-3961)

  - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with     read-only permissions when the Samba VFS module acl_xattr is configured with acl_xattr:ignore system     acls = yes. The SMB protocol allows opening files when the client requests read-only access but then     implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create     disposition request. The issue arises in configurations that bypass kernel file system permissions checks,     relying solely on Samba's permissions. (CVE-2023-4091)

  - A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in     Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and     users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and     passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain     access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC     distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-     of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker     influence. (CVE-2023-4154)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

  - A vulnerability was found in Samba's rpcecho development server, a non-Windows RPC server used to test     Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked     indefinitely. The issue arises because the rpcecho service operates with only one worker in the main RPC     task, allowing calls to the rpcecho server to be blocked for a specified time, causing service     disruptions. This disruption is triggered by a sleep() call in the dcesrv_echo_TestSleep() function     under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls     to the rpcecho server, requesting it to block for a specified duration, effectively disrupting most     services and leading to a complete denial of service on the AD DC. The DoS affects all other services as     rpcecho runs in the main RPC task. (CVE-2023-42669)

  - A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners     can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high     load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation classic     DCs) can erroneously start and compete for the same unix domain sockets. This issue leads to partial     query responses from the AD DC, causing issues such as The procedure number is out of range when using     tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
183005	SUSE SLED15: ctdb / ctdb-pcp-pmda / libsamba-policy-devel / etc (SUSE-SU-2023:4046-1)	Nessus	SuSE Local Security Checks	2023/10/13	2026/6/26	critical
183282	SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2023:4096-1)	Nessus	SuSE Local Security Checks	2023/10/18	2026/6/26	medium
190761	GLSA-202402-28 : Samba: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/2/20	2024/2/20	critical

偵測

搜尋 Plugin

critical

medium

critical