The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3647-1 advisory.

    - CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers     (bsc#1192246).
    - CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).
    - CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).
    - CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain     members (bsc#1192284).
    - CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).
    - CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation     issues) (bsc#1192283).
    - CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state     (bsc#1192214).
    - CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

    Samba was updated to 4.13.13

    * rodc_rwdc test flaps;(bso#14868).
    * Backport bronze bit fixes, tests, and selftest improvements;
      (bso#14881).
    * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]       'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba       with embedded Heimdal;(bso#14642).
    * Python ldb.msg_diff() memory handling failure;(bso#14836).
    * 'in' operator on ldb.Message is case sensitive;(bso#14845).
    * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
    * Allow special chars like '@' in samAccountName when generating       the salt;(bso#14874).
    * Fix transit path validation;(bso#12998).
    * Prepare to operate with MIT krb5 >= 1.20;(bso#14870).
    * rpcclient NetFileEnum and net rpc file both cause lock order       violation: brlock.tdb, share_entries.tdb;(bso#14645).
    * Python ldb.msg_diff() memory handling failure;(bso#14836).
    * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

    Samba was updated to 4.13.12:

    * Address a signifcant performance regression in database access       in the AD DC since Samba 4.12;(bso#14806).
    * Fix performance regression in lsa_LookupSids3/LookupNames4       since Samba 4.9 by using an explicit database handle cache;
      (bso#14807).
    * An unuthenticated user can crash the AD DC KDC by omitting the       server name in a TGS-REQ;(bso#14817).
    * Address flapping samba_tool_drs_showrepl test;(bso#14818).
    * Address flapping dsdb_schema_attributes test;(bso#14819).
    * An unuthenticated user can crash the AD DC KDC by omitting the       server name in a TGS-REQ;(bso#14817).
    * Fix CTDB flag/status update race conditions(bso#14784).

    Samba was updated to 4.13.11:

    * smbd: panic on force-close share during offload write; (bso#14769).
    * Fix returned attributes on fake quota file handle and avoid       hitting the VFS;(bso#14731).
    * smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).
    * net conf list crashes when run as normal user;(bso#14787).
    * Work around special SMB2 READ response behavior of NetApp Ontap       7.3.7;(bso#14607).
    * Start the SMB encryption as soon as possible;(bso#14793).
    * Winbind should not start if the socket path for the privileged       pipe is too long;(bso#14792).

    ldb was updated to 2.2.2:

    + CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246);
    (bso#14558)     + CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

    Release ldb 2.2.2

    + Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).
    + Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)     + Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Samba running on the remote host is 4.13.x prior to 4.13.14, 4.14.x prior to 4.14.10, or 4.15.x prior to 4.15.2.  It is, therefore, potentially affected by multiple vulnerabilities as referenced in the vendor advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0076 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets (CVE-2020-25719)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2149 advisory.

    A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication.   The Samba AD DC, could become confused about the user a ticket represents if it     did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include     total domain compromise. (CVE-2020-25719)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0117 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10195:
    A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x     versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included     passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as     arguments or options is not performed by default in FreeIPA but is possible by third-party components. An     attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content     with passwords exposed.

    CVE-2019-14867:
    A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x     versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA     server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb     principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be     executed on the server hosting the IPA server.

    CVE-2020-25719:
    A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2791:05 advisory.

    * samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets (CVE-2020-25719)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of samba installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-25719 advisory.

  - A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise. (CVE-2020-25719)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise. (CVE-2020-25719)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0117 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-10195:
    A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x     versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included     passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as     arguments or options is not performed by default in FreeIPA but is possible by third-party components. An     attacker having access to system logs on FreeIPA masters could use this flaw to produce log file content     with passwords exposed.

    CVE-2019-14867:
    A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x     versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA     server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb     principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be     executed on the server hosting the IPA server.

    CVE-2020-25719:
    A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-     based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did     not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total     domain compromise.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:5142 advisory.

  - samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets (CVE-2020-25719)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2021_5142 advisory.

    * samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets (CVE-2020-25719)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
155048	SUSE SLED15: ctdb / ldb-tools / libdcerpc-binding0 / libdcerpc-binding0-32bit / etc (SUSE-SU-2021:3647-1)	Nessus	SuSE Local Security Checks	2021/11/11	2026/6/25	high
155620	Samba 4.13.x < 4.13.14 / 4.14.x < 4.14.10 / 4.15.x < 4.15.2 Multiple Vulnerabilities	Nessus	Misc.	2021/11/19	2022/11/28	high
156660	RHEL 8 : idm:DL1 (RHSA-2022:0076)	Nessus	Red Hat Local Security Checks	2022/1/12	2024/11/7	high
178496	Amazon Linux 2 : ipa (ALAS-2023-2149)	Nessus	Amazon Linux Local Security Checks	2023/7/20	2024/12/11	high
236531	Alibaba Cloud Linux 3 : 0117: idm:DL1 (ALINUX3-SA-2022:0117)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
293869	MiracleLinux 7 : ipa-4.6.8-5.10.0.1.el7.AXS7 (AXSA:2021-2791:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
295838	Azure Linux 3.0 Security Update: samba (CVE-2020-25719)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	high
252460	Linux Distros Unpatched Vulnerability : CVE-2020-25719	Nessus	Misc.	2025/8/20	2026/7/24	high
276345	TencentOS Server 3: idm:DL1 (TSSA-2022:0117)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/5	high
156117	CentOS 8 : idm:DL1 (CESA-2021:5142)	Nessus	CentOS Local Security Checks	2021/12/16	2022/3/1	high
358591	Rocky Linux 8 [CIQ] Security Update: bind-dyndb-ldap / bind-dyndb-ldap-debuginfo / etc (crlsa-2021_5142)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high