バナーによると、リモートホストでのSambaサーバーのバージョンは、3.2.0～3.2.6（これらのバージョンを含みます）です。そのようなバージョンでは、認証されたリモートユーザーが、3.0.28より前のバージョンのsmbclientから ''（空の文字列）と呼ばれる共有をリクエストすることで、自身の権限にしたがってrootファイルシステムへのアクセス権を取得することが報告されています。この問題を悪用するには、「レジストリの共有」を有効にする必要があります。これはデフォルトでは有効になっていません。

注意：Nessusは、この問題の悪用や、「レジストリの共有」が有効になっているかどうかの確認、修正が適用されているかどうかの確認を実際には試行していません。

This update fixes a bug that allowed the client to retrieve arbitrary memory content from the server process. (CVE-2008-4314) Additionally another bug was fixed that affects environments that enabled registry shares by setting 'registry shares = yes'. In this case an authenticated user is accidentally allowed to access the root filesystem '/'. (CVE-2009-0022)

Gunter Hockel discovered that Samba with registry shares enabled did not properly validate share names. An authenticated user could gain access to the root filesystem by using an older version of smbclient and specifying an empty string as a share name. This is only an issue if registry shares are enabled on the server by setting 'registry shares = yes', 'include = registry', or 'config backend = registry', which is not the default.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

根据其标题，远程主机上运行的 Samba 服务器版本为 3.2.0 到 3.2.6（含）。据报告，此类版本允许经过身份验证的远程用户以其特权来获取根文件系统的访问权限，方法是从低于 3.0.28 的 smbclient 版本中，请求共享 ''（空字符串）。成功利用此问题需要启用“注册表共享”，此选项在默认情况下不启用。

请注意，Nessus 尚未实际尝试利用此问题或确定是否已启用“注册表共享”或是否已应用修复程序。

根據其標題來判斷，遠端主機上執行的 Samba 是介於 3.2.0 與 3.2.6 (含) 之間的版本。據報，這些版本允許經驗證的遠端使用者提出名為「 ''」(空字串) 的共用要求，藉此使用自身權限從 3.0.28 之前版本的 smbclient 取得 Root 層級的檔案系統存取權。若要成功攻擊此問題，需要啟用「registry share」，此選項預設為停用。

請注意，Nessus 尚未確實嘗試惡意利用此問題，或者判斷是否已啟用「registry share」或已套用修正程式。

Security fix for CVE-2009-0022

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted connection request that specifies a blank share name (CVE-2009-0022).

This update provides samba 3.2.7 to address this issue.

New samba packages are available for Slackware 12.2 and -current to fix a security issue.

According to its banner, the version of the Samba server on the remote host is between 3.2.0 and 3.2.6 inclusive. Such versions reportedly allow an authenticated, remote user to gain access to the root filesystem, subject to his or her privileges, by making a request for a share called '' (empty string) from a version of smbclient prior to 3.0.28. Successful exploitation of this issue requires 'registry shares' to be enabled, which is not enabled by default.

Note that Nessus has not actually tried to exploit this issue or to determine if 'registry shares' is enabled or if the fix has been applied.

According to its banner, the version of the Samba server on the remote host is between 3.2.0 and 3.2.6 inclusive.  Such versions reportedly allow an authenticated remote user to gain access to the root filesystem, subject to his or her privileges, by making a request for a share called '' (empty string) from a version of smbclient prior to 3.0.28.  Successful exploitation of this issue requires 'registry shares' to be enabled, which is not enabled by default.

ID	名稱	產品	系列	已發布	已更新	嚴重性
35298	Samba 3.2.0 - 3.2.6の承認されていないファイルアクセス	Nessus	Misc.	2009/1/6	2018/11/15	medium
40197	openSUSE Security Update : cifs-mount (cifs-mount-410)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
37362	Ubuntu 8.10 : samba vulnerability (USN-702-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	medium
35298	Samba 3.2.0 - 3.2.6 未授权的访问	Nessus	Misc.	2009/1/6	2018/11/15	medium
35298	Samba 3.2.0 - 3.2.6 未經授權的存取	Nessus	Misc.	2009/1/6	2018/11/15	medium
35395	Fedora 9 : samba-3.2.7-0.23.fc9 (2009-0268)	Nessus	Fedora Local Security Checks	2009/1/16	2021/1/11	medium
37415	Mandriva Linux Security Advisory : samba (MDVSA-2009:042)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	medium
35292	Slackware 12.2 / current : samba (SSA:2009-005-01)	Nessus	Slackware Local Security Checks	2009/1/6	2021/1/14	medium
35298	Samba 3.2.0 - 3.2.6 Unauthorized Access	Nessus	Misc.	2009/1/6	2018/11/15	medium
39927	openSUSE Security Update : cifs-mount (cifs-mount-406)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
4807	Samba 3.2.0 - 3.2.6 Unauthorized Access	Nessus Network Monitor	Samba	2009/1/6	2019/3/6	medium

偵測

搜尋 Plugin

medium

high

medium

medium

medium

medium

medium

medium

medium

high

medium