A denial of service flaw was found in the LDAP server provided by the AD DC in the Samba process daemon. A remote attacker could exploit this flaw by sending a specially crafted packet, which could cause the server to consume an excessive amount of memory and crash.
(CVE-2015-7540)

Multiple buffer over-read flaws were found in the way Samba handled malformed inputs in certain encodings. An authenticated, remote attacker could possibly use these flaws to disclose portions of the server memory. (CVE-2015-5330)

A man-in-the-middle vulnerability was found in the way 'connection signing' was implemented by Samba. A remote attacker could use this flaw to downgrade an existing Samba client connection and force the use of plain text. (CVE-2015-5296)

A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORY_LIST access rights. (CVE-2015-5299)

An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path.
(CVE-2015-5252)

After installing this update, the smb service will be restarted automatically.

Updated samba packages that fix multiple security issues are now available for Red Hat Gluster Storage 3.1 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A man-in-the-middle vulnerability was found in the way 'connection signing' was implemented by Samba. A remote attacker could use this flaw to downgrade an existing Samba client connection and force the use of plain text. (CVE-2015-5296)

A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORY_LIST access rights. (CVE-2015-5299)

Multiple buffer over-read flaws were found in the way Samba handled malformed inputs in certain encodings. An authenticated, remote attacker could possibly use these flaws to disclose portions of the server memory. (CVE-2015-5330)

An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path.
(CVE-2015-5252)

Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Stefan Metzmacher of the Samba Team and Sernet.de as the original reporters of CVE-2015-5296, partha@exablox.com as the original reporter of CVE-2015-5299, Jan 'Yenya' Kasprzak and the Computer Systems Unit team at Faculty of Informatics, Masaryk University as the original reporters of CVE-2015-5252 flaws, and Douglas Bagnall as the original reporter of CVE-2015-5330.

All samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-023:01 advisory.

    Samba is the standard Windows interoperability suite of programs for Linux and Unix.
    Security issues fixed with this release:
    CVE-2015-3223     The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24,     as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x before     4.2.7, and 4.3.x before 4.3.3, mishandles certain zero values, which     allows remote attackers to cause a denial of service (infinite loop)     via crafted packets.
    CVE-2015-5252     vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7,     and 4.3.x before 4.3.3, when share names with certain substring     relationships exist, allows remote attackers to bypass intended     file-access restrictions via a symlink that points outside of a share.
    CVE-2015-5296     Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before     4.3.3 supports connections that are encrypted but unsigned, which     allows man-in-the-middle attackers to conduct encrypted-to-unencrypted     downgrade attacks by modifying the client-server data stream, related     to clidfs.c, libsmb_server.c, and smbXcli_base.c.
    CVE-2015-5299     The shadow_copy2_get_shadow_copy_data function in     modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x     before 4.2.7, and 4.3.x before 4.3.3 does not verify that the     DIRECTORY_LIST access right has been granted, which allows remote     attackers to access snapshots by visiting a shadow copy directory.
    CVE-2015-7540     The LDAP server in the AD domain controller in Samba 4.x before 4.1.22     does not check return values to ensure successful ASN.1 memory     allocation, which allows remote attackers to cause a denial of service     (memory consumption and daemon crash) via crafted packets.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to Samba 4.3.3 (security release)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has samba packages installed that are affected by multiple vulnerabilities:

  - Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow     remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum     (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount     (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2     (lsa_io_trans_names). (CVE-2007-2446)

  - The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute     arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the     username map script smb.conf option is enabled, and allows remote authenticated users to execute     commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file     share management. (CVE-2007-2447)

  - Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0 through 3.0.29     allows remote attackers to execute arbitrary code via a crafted SMB response. (CVE-2008-1105)

  - Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB     subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating     systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users     to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances     involving user accounts that lack home directories. (CVE-2009-2813)

  - smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote     authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break     notification reply packet. (CVE-2009-2906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were found in Samba, a SMB/CIFS implementation that provides a file, print, and login server.

CVE-2015-5252

Jan 'Yenya' Kasprzak and the Computer Systems Unit team at Faculty of Informatics, Masaryk University, reported that samba wrongly verified symlinks, making it possible to access resources outside the shared path, under certain circumstances.

CVE-2015-5296

Stefan Metzmacher of SerNet and the Samba Team discovered that samba did not ensure that signing was negotiated when a client established an encrypted connection against a samba server.

CVE-2015-5299

Samba was vulnerable to a missing access control check in the VFS shadow_copy2 module, that could allow unauthorized users to access snapshots.

For Debian 6 'Squeeze', this issue has been fixed in samba version 2:3.5.6~dfsg-3squeeze13. We recommend you to upgrade your samba packages.

Learn more about the Debian Long Term Support (LTS) Project and how to apply these updates at: https://wiki.debian.org/LTS/

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Samba is an open source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information.

A denial of service flaw was found in the LDAP server provided by the AD DC in the Samba process daemon. A remote attacker could exploit this flaw by sending a specially crafted packet, which could cause the server to consume an excessive amount of memory and crash.
(CVE-2015-7540)

Multiple buffer over-read flaws were found in the way Samba handled malformed inputs in certain encodings. An authenticated, remote attacker could possibly use these flaws to disclose portions of the server memory. (CVE-2015-5330)

A man-in-the-middle vulnerability was found in the way 'connection signing' was implemented by Samba. A remote attacker could use this flaw to downgrade an existing Samba client connection and force the use of plain text. (CVE-2015-5296)

A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORY_LIST access rights. (CVE-2015-5299)

An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path.
(CVE-2015-5252)

Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Stefan Metzmacher of the Samba Team and Sernet.de as the original reporters of CVE-2015-5296, partha@exablox.com as the original reporter of CVE-2015-5299, Jan 'Yenya' Kasprzak and the Computer Systems Unit team at Faculty of Informatics, Masaryk University as the original reporters of CVE-2015-5252 flaws, and Douglas Bagnall as the original reporter of CVE-2015-5330.

All samba users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically.

Update to Samba 4.2.7 (security release)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
87844	Scientific Linux Security Update : samba on SL7.x x86_64 (20160107)	Nessus	Scientific Linux Local Security Checks	2016/1/11	2021/1/14	high
87856	RHEL 7 : Storage Server (RHSA-2016:0016)	Nessus	Red Hat Local Security Checks	2016/1/12	2019/10/24	high
289407	MiracleLinux 7 : samba-4.2.3-11.el7 (AXSA:2016-023:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
89376	Fedora 23 : samba-4.3.3-0.fc23 (2015-b36076d32e)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high
206855	NewStart CGSL MAIN 6.02 : samba Multiple Vulnerabilities (NS-SA-2024-0054)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/17	critical
87683	Debian DLA-379-1 : samba security update	Nessus	Debian Local Security Checks	2016/1/4	2021/1/11	high
87779	CentOS 7 : samba (CESA-2016:0006)	Nessus	CentOS Local Security Checks	2016/1/8	2021/1/4	high
90558	openSUSE Security Update : samba (openSUSE-2016-462) (Badlock)	Nessus	SuSE Local Security Checks	2016/4/18	2021/1/19	high
89144	Fedora 22 : samba-4.2.7-0.fc22 (2015-0e0879cc8a)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high

検出

プラグインの検索

high

high

high

high

critical

high

high

high

high