Multiple vulnerabilities has been found and corrected in samba (swat) :

The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element (CVE-2013-0213).

Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions (CVE-2013-0214).

The updated packages have been patched to correct these issues.

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed.

Additionally a bug in mount.cifs has been fixed which could have lead to file disclosure. (CVE-2012-1586)

Also a uninitialized memory read bug in talloc_free() has been fixed.
. (bnc#764577)

This is a LTSS roll-up update for the Samba Server suite fixing multiple security issues and bugs.

Security issues fixed :

  - CVE-2013-4496: Password lockout was not enforced for     SAMR password changes, leading to brute force     possibility.

  - CVE-2013-4408: DCE-RPC fragment length field is     incorrectly checked.

  - CVE-2013-4124: Samba was affected by a denial of service     attack on authenticated or guest connections.

  - CVE-2013-0214: The SWAT webadministration was affected     by a cross site scripting attack (XSS).

  - CVE-2013-0213: The SWAT webadministration could possibly     be used in clickjacking attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2922-1 advisory.

    Jeremy Allison discovered that Samba incorrectly handled ACLs on symlink paths. A remote attacker could     use this issue to overwrite the ownership of ACLs using symlinks. (CVE-2015-7560)

    Garming Sam and Douglas Bagnall discovered that the Samba internal DNS server incorrectly handled certain     DNS TXT records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of     service, or possibly obtain uninitialized memory contents. This issue only applied to Ubuntu 14.04 LTS and     Ubuntu 15.10. (CVE-2016-0771)

    It was discovered that the Samba Web Administration Tool (SWAT) was vulnerable to clickjacking and cross-     site request forgery attacks. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-0213, CVE-2013-0214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Samba running on the remote host is 3.5.x prior to 3.5.21, 3.6.x prior to 3.6.12, or 4.x prior to 4.0.1. It is, therefore, affected by the following vulnerabilities :

  - An unspecified flaw exists in the Samba Web     Administration Tool (SWAT) that allows a remote attacker     to conduct clickjacking attacks via a FRAME or IFRAME     element. (CVE-2013-0213)

  - A cross-site request forgery vulnerability exists due to     a failure to require multiple steps or explicit     confirmation for sensitive transactions in the Samba     Web Administration Tool (SWAT). A remote attacker can     exploit this, by convincing a user to follow a crafted     URL, to cause the user to perform unintended actions.
    (CVE-2013-0213)

Note that these vulnerabilities are only exploitable when SWAT is enabled, and it is not enabled by default. Additionally, note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1310 advisory.

    - resolves: #984807 - CVE-2013-4124: DoS via integer overflow when reading                           an EA list
    - Fix CVE-2013-0213 and CVE-2013-0214.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.
(CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba server.

After installing this update, the smb service will be restarted automatically.

Updated samba packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session.
(CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba server.

Red Hat would like to thank the Samba project for reporting CVE-2013-0213 and CVE-2013-0214. Upstream acknowledges Jann Horn as the original reporter of CVE-2013-0213 and CVE-2013-0214.

All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery (CVE-2013-0214) and a click-jacking attack (CVE-2013-0213). This has been fixed.

Additionally a bug in mount.cifs has been fixed which could have lead to file disclosure (CVE-2012-1586).

Also a uninitialized memory read bug in talloc_free() has been fixed.
(bnc#764577).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-583:01 advisory.

    Description :
    Samba is the suite of programs by which a lot of PC-related machines     share files, printers, and other information (such as lists of     available files and printers). The Windows NT, OS/2, and Linux     operating systems support this natively, and add-on packages can     enable the same thing for DOS, Windows, VMS, UNIX of all kinds, MVS,     and more. This package provides an SMB server that can be used to     provide network services to SMB (sometimes called Lan Manager)     clients. Samba uses NetBIOS over TCP/IP (NetBT) protocols and does NOT     need the NetBEUI (Microsoft Raw NetBIOS frame) protocol.
    Security issues fixed with this release:
    CVE-2013-0213     The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before     4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
    CVE-2013-0214     Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x     before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the     authentication of arbitrary users by leveraging knowledge of a password and composing requests that     perform SWAT actions.
    CVE-2013-4124     Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22,     3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory     consumption) via a malformed packet.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0305 advisory.

    - Security Release, fixes CVE-2013-0213 and CVE-2013-4124

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 3.6.12 which fixes CVE-2013-0213 and CVE-2013-0214. Update to 3.6.10. Fix printing upgrade code.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
64626	Mandriva Linux Security Advisory : samba (MDVSA-2013:011)	Nessus	Mandriva Local Security Checks	2013/2/14	2021/1/6	medium
64865	SuSE 10 Security Update : Samba (ZYPP Patch Number 8449)	Nessus	SuSE Local Security Checks	2013/2/23	2021/1/19	medium
83623	SUSE SLES11 Security Update : Samba (SUSE-SU-2014:0723-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
89777	Ubuntu 14.04 LTS : Samba vulnerabilities (USN-2922-1)	Nessus	Ubuntu Local Security Checks	2016/3/9	2025/9/3	medium
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
64459	Samba < 3.5.21 / 3.6.12 / 4.0.2 SWAT Multiple Vulnerabilities	Nessus	Misc.	2013/2/4	2018/11/15	medium
64862	SuSE 11.2 Security Update : Samba (SAT Patch Number 7292)	Nessus	SuSE Local Security Checks	2013/2/24	2021/1/19	medium
70346	Oracle Linux 5 : samba3x (ELSA-2013-1310)	Nessus	Oracle Linux Local Security Checks	2013/10/9	2024/10/22	high
70390	Scientific Linux Security Update : samba3x on SL5.x i386/x86_64 (20130930)	Nessus	Scientific Linux Local Security Checks	2013/10/11	2021/1/14	medium
71201	Scientific Linux Security Update : samba on SL6.x i386/x86_64 (20131121)	Nessus	Scientific Linux Local Security Checks	2013/12/4	2021/1/14	medium
73063	CentOS 5 : samba (CESA-2014:0305)	Nessus	CentOS Local Security Checks	2014/3/18	2021/1/4	medium
73072	RHEL 5 : samba (RHSA-2014:0305)	Nessus	Red Hat Local Security Checks	2014/3/18	2021/1/14	medium
83575	SUSE SLED10 / SLES10 Security Update : Samba (SUSE-SU-2013:0325-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	medium
289385	MiracleLinux 3 : samba-3.0.33-3.40.0.1.AXS3 (AXSA:2014-583:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
73070	Oracle Linux 5 : samba (ELSA-2014-0305)	Nessus	Oracle Linux Local Security Checks	2014/3/18	2024/10/22	high
64598	Fedora 16 : samba-3.6.12-1.fc16 (2013-1716)	Nessus	Fedora Local Security Checks	2013/2/13	2021/1/11	medium

偵測

搜尋 Plugin

medium

medium

high

medium

critical

medium

medium

high

medium

medium

medium

medium

medium

high

high

medium