EulerOS Virtualization 2.11.0 : samba (EulerOS-SA-2026-3558)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347188);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2025-9640",
    "CVE-2025-10230",
    "CVE-2026-4408",
    "CVE-2026-4480"
  );
  script_xref(name:"IAVA", value:"2025-A-0777-S");
  script_xref(name:"IAVA", value:"2026-A-0510-S");

  script_name(english:"EulerOS Virtualization 2.11.0 : samba (EulerOS-SA-2026-3558)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is
affected by the following vulnerabilities :

    Upstream Security Advisories: https://www.samba.org/samba/security/CVE-2007-2447.html
    https://www.samba.org/samba/security/CVE-2025-10230.html
    https://www.samba.org/samba/security/CVE-2025-9640.html(CVE-2025-10230)

    A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be
    written into alternate data streams. This allows an authenticated user to read residual memory content
    that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

    A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and
    classic domain controllers that use the 'check password script' feature. If this script is configured with
    the %u substitution character, the client-controlled username is passed without proper escaping of shell
    meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected
    system. This issue primarily affects non-standard configurations where the 'check password script' is used
    with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)

    A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description
    string to the command configured with the 'print command' setting via the '%J'substitution character
    without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a
    specially crafted print job description that contains unescaped shell characters. This could lead to
    remote code execution on the affected system.(CVE-2026-4480)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3558
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a311cdbe");
  script_set_attribute(attribute:"solution", value:
"Update the affected samba packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-4480");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsmbclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libwbclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-common-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind-clients");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind-modules");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:2.11.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "2.11.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 2.11.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "x86" >!< cpu) audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);

var flag = 0;

var pkgs = [
  "libsmbclient-4.15.3-4.h28.eulerosv2r11",
  "libwbclient-4.15.3-4.h28.eulerosv2r11",
  "samba-4.15.3-4.h28.eulerosv2r11",
  "samba-client-4.15.3-4.h28.eulerosv2r11",
  "samba-common-4.15.3-4.h28.eulerosv2r11",
  "samba-common-tools-4.15.3-4.h28.eulerosv2r11",
  "samba-help-4.15.3-4.h28.eulerosv2r11",
  "samba-libs-4.15.3-4.h28.eulerosv2r11",
  "samba-winbind-4.15.3-4.h28.eulerosv2r11",
  "samba-winbind-clients-4.15.3-4.h28.eulerosv2r11",
  "samba-winbind-modules-4.15.3-4.h28.eulerosv2r11"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "samba");
}