EulerOS 2.0 SP15 : samba (EulerOS-SA-2026-3822)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346759);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/17");

  script_cve_id(
    "CVE-2026-3012",
    "CVE-2026-3238",
    "CVE-2026-4408",
    "CVE-2026-4480"
  );
  script_xref(name:"IAVA", value:"2026-A-0510-S");

  script_name(english:"EulerOS 2.0 SP15 : samba (EulerOS-SA-2026-3822)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by
the following vulnerabilities :

    A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-
    enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install
    it into the local trust store without proper verification. An attacker with the ability to intercept or
    redirect network traffic could exploit this behavior to supply a malicious certificate authority
    certificate, potentially allowing interception or spoofing of trusted communications.(CVE-2026-3012)

    A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and
    classic domain controllers that use the 'check password script' feature. If this script is configured with
    the %u substitution character, the client-controlled username is passed without proper escaping of shell
    meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected
    system. This issue primarily affects non-standard configurations where the 'check password script' is used
    with %u and the samba-dcerpcd service is started as a system service.(CVE-2026-4408)

    A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description
    string to the command configured with the 'print command' setting via the '%J'_x000D_
    substitution character without escaping shell meta characters. A remote attacker could exploit this
    vulnerability by sending a specially crafted print job description that contains unescaped shell
    characters. This could lead to remote code execution on the affected system.(CVE-2026-4480)

    ['-------- Forwarded Message --------', 'Date: Tue, 26 May 2026 14:29:50 +0200', 'Reply-To: Stefan
    Metzmacher metze () samba org', 'Release Announcements\n---------------------\n\nThis is a security
    release in order to address the following defects:\n\no CVE-2026-1933:   Missing access checks on reparse
    point operations\n\n                   On a share marked 'read only = yes' and\n                   on file
    handles opened R/O users can set\n                   or delete the reparse point xattrs on files\n
    that the user has write-access in the file\n                   system for.', 'o CVE-2026-2340:   WORM vfs
    module does not block overwrites\n\n                   The WORM (Write-Once, Read Many) vfs module\n
    is supposed to lock write access to shared\n                   files, so they cannot be altered after
    initial\n                   writes. It was allowing files to be overwritten\n                   by
    renaming a newly created file over a protected\n                   file.', 'o CVE-2026-3012:   auto-
    enrolment GPO installing CA certificate over http\n                   without verification\n\n
    To bootstrap a certificate chain a domain member must\n                   fetch a certificate without TLS.
    It was trusting HTTP\n                   for this when a more secure encrypted LDAP channel\n
    was also available.', 'o CVE-2026-3238:   Denial of service against AD DC WINS server\n\n
    The WINS server component of the Active\n                   Directory Domain controller code in Samba\n
    is vulnerable to a NULL pointer dereference\n                   and crash caused by a unauthenticated
    UDP\n                   packet.', 'server', ''check password script' that has the %u substitution\n
    character are vulnerable to a remote code execution.', 'o CVE-2026-4480:   Unauthenticated Remote Code
    Execution in Samba printing\n                   subsystem\n\n                   Samba print servers with a
    'print command'\n                   that has the %J substitution character\n                   are
    vulnerable to a Remote Code Execution.', 'Changes\n-------\n\no  Douglas Bagnall douglas.bagnall ()
    catalyst net nz\n   * BUG 15997: CVE-2026-2340\n   * BUG 16003: CVE-2026-3012\n   * BUG 16033:
    CVE-2026-4480\n   * BUG 16034: CVE-2026-4408\n\no  Pavel Kohout pavel () aisle com\n   * BUG 15997:
    CVE-2026-2340\n\no  Volker Lendecke vl () samba org\n   * BUG 15992: CVE-2026-1933\n   * BUG 16012:
    CVE-2026-3238\n\no  Stefan Metzmacher metze () samba org\n   * BUG 15992: CVE-2026-1933\n   * BUG
    16033: CVE-2026-4480\n   * BUG 16034: CVE-2026-4408', 'has Homedir / In
    passwd\n\n#######################################\nReporting bugs  Development
    Discussion\n#######################################\n\nPlease discuss this release on the samba-technical
    mailing list or by\njoining the #samba-technical:matrix.org matrix room, or\n#samba-technical IRC channel
    on irc.libera.chat.\n\nIf you do report problems then please try to send high quality\nfeedback. If you
    don't provide vital information to help us track down\nthe problem then you will probably be ignored.  All
    bug reports should\nbe filed under the Samba 4.1 and newer product in the project's Bugzilla\ndatabase (',
    ').\n\n\n======================================================================\n== Our Code, Our Bugs,
    Our Responsibility.\n== The Samba Team\n==================================================================
    ====\n\n\n\n================\nDownload Details\n================\n\nThe uncompressed tarballs and patch
    files have been signed\nusing GnuPG (ID AA99442FB680B620).  The source code can be downloaded\nfrom:',
    'The release notes are available online at:', 'Our Code, Our Bugs, Our Responsibility.\n(', ')\n\n
    --Enjoy\n                        The Samba Team'](CVE-2026-3238)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3822
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c268ef2c");
  script_set_attribute(attribute:"solution", value:
"Update the affected samba packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-4480");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libsmbclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:libwbclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-client-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-common-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-help");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind-clients");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:samba-winbind-modules");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "libsmbclient-4.19.3-6.h21510.4.eulerosv2r15",
  "libwbclient-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-client-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-client-libs-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-common-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-common-tools-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-help-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-libs-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-winbind-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-winbind-clients-4.19.3-6.h21510.4.eulerosv2r15",
  "samba-winbind-modules-4.19.3-6.h21510.4.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "samba");
}