The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:2313 advisory.

  - samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process     token (CVE-2021-20254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to     retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
    (CVE-2016-2124)

  - A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use     this flaw to cause possible privilege escalation. (CVE-2020-25717)

  - A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end     of the array in the case where a negative cache entry had been added to the mapping cache. This could     cause the calling code to return those values into the process token that stores the group membership for     a user. The highest threat from this vulnerability is to data confidentiality and integrity.
    (CVE-2021-20254)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

  - The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide '...enhanced compatibility     with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver.' Samba versions prior to     4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via     specially crafted extended file attributes. A remote attacker with write access to extended file     attributes can execute arbitrary code with the privileges of smbd, typically root. (CVE-2021-44142)

  - A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client     had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or     printer) instead of client-supplied data. The client cannot control the area of the server memory written     to the file (or printer). (CVE-2022-32742)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4058 advisory.

  - samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process     token (CVE-2021-20254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4058 advisory.

  - samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process     token (CVE-2021-20254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in samba. The Samba smbd file server     must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a     flaw that could allow it to read data beyond the end of     the array in the case where a negative cache entry had     been added to the mapping cache. This could cause the     calling code to return those values into the process     token that stores the group membership for a user. The     highest threat from this vulnerability is to data     confidentiality and integrity.(CVE-2021-20254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference, or possible use-after-free     flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4.
    Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the     affected code is shipped with the libldb package. This     flaw allows an authenticated user to possibly trigger a     use-after-free or NULL pointer dereference. The highest     threat from this vulnerability is to system     availability.(CVE-2020-10730)

  - A flaw was found in Samba's libldb. Multiple,     consecutive leading spaces in an LDAP attribute can     lead to an out-of-bounds memory write, leading to a     crash of the LDAP server process handling the request.
    The highest threat from this vulnerability is to system     availability.(CVE-2021-20277)

  - A flaw was found in samba. Spaces used in a string     around a domain name (DN), while supposed to be     ignored, can cause invalid DN strings with spaces to     instead write a zero-byte into out-of-bounds memory,     resulting in a crash. The highest threat from this     vulnerability is to system     availability.(CVE-2020-27840)

  - A flaw was found in samba. The Samba smbd file server     must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a     flaw that could allow it to read data beyond the end of     the array in the case where a negative cache entry had     been added to the mapping cache. This could cause the     calling code to return those values into the process     token that stores the group membership for a user. The     highest threat from this vulnerability is to data     confidentiality and integrity.(CVE-2021-20254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3187-1 advisory.

  - A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be     ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory,     resulting in a crash. The highest threat from this vulnerability is to system availability.
    (CVE-2020-27840)

  - A flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end     of the array in the case where a negative cache entry had been added to the mapping cache. This could     cause the calling code to return those values into the process token that stores the group membership for     a user. The highest threat from this vulnerability is to data confidentiality and integrity.
    (CVE-2021-20254)

  - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to     an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The     highest threat from this vulnerability is to system availability. (CVE-2021-20277)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 20.10 / 21.04 host has packages installed that are affected by a vulnerability as referenced in the USN-4930-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for samba fixes the following issues :

CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).

Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).

Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).

CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).

CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).

Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).

s3-libads: use dns name to open a ldap session (bsc#1184310).

Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A flaw was found in samba. The Samba smbd file server     must map Windows group identities (SIDs) into unix     group ids (gids). The code that performs this had a     flaw that could allow it to read data beyond the end of     the array in the case where a negative cache entry had     been added to the mapping cache. This could cause the     calling code to return those values into the process     token that stores the group membership for a user. The     highest threat from this vulnerability is to data     confidentiality and integrity.(CVE-2021-20254)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
150767	CentOS 7 : samba (CESA-2021:2313)	Nessus	CentOS Local Security Checks	2021/6/14	2022/1/26	medium
170834	EulerOS Virtualization 3.0.2.2 : samba (EulerOS-SA-2023-1293)	Nessus	Huawei Local Security Checks	2023/1/30	2023/2/3	high
154847	RHEL 8 : samba (RHSA-2021:4058)	Nessus	Red Hat Local Security Checks	2021/11/2	2024/4/28	medium
154870	CentOS 8 : samba (CESA-2021:4058)	Nessus	CentOS Local Security Checks	2021/11/3	2022/1/26	medium
153050	EulerOS 2.0 SP5 : samba (EulerOS-SA-2021-2347)	Nessus	Huawei Local Security Checks	2021/9/7	2023/12/1	medium
153277	EulerOS 2.0 SP2 : samba (EulerOS-SA-2021-2446)	Nessus	Huawei Local Security Checks	2021/9/14	2021/9/16	medium
153580	SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2021:3187-1)	Nessus	SuSE Local Security Checks	2021/9/23	2023/7/13	medium
149093	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Samba vulnerability (USN-4930-1)	Nessus	Ubuntu Local Security Checks	2021/4/30	2023/10/16	medium
149135	SUSE SLES15 Security Update : samba (SUSE-SU-2021:1445-1)	Nessus	SuSE Local Security Checks	2021/4/30	2022/1/26	medium
149152	SUSE SLES12 Security Update : samba (SUSE-SU-2021:1442-1)	Nessus	SuSE Local Security Checks	2021/4/30	2022/1/26	medium
149263	SUSE SLES12 Security Update : samba (SUSE-SU-2021:1492-1)	Nessus	SuSE Local Security Checks	2021/5/5	2022/1/26	medium
149270	SUSE SLES15 Security Update : samba (SUSE-SU-2021:1498-1)	Nessus	SuSE Local Security Checks	2021/5/5	2022/1/26	medium
152333	EulerOS 2.0 SP9 : samba (EulerOS-SA-2021-2282)	Nessus	Huawei Local Security Checks	2021/8/9	2023/12/6	medium
151563	EulerOS Virtualization 2.9.1 : samba (EulerOS-SA-2021-2179)	Nessus	Huawei Local Security Checks	2021/7/13	2023/12/8	medium

偵測

搜尋 Plugin

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium