Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text is (C) Scientific Linux.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(60309);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/14");

  script_cve_id("CVE-2007-4138", "CVE-2007-4572", "CVE-2007-5398");

  script_name(english:"Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Scientific Linux host is missing one or more security
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"A buffer overflow flaw was found in the way Samba creates NetBIOS
replies. If a Samba server is configured to run as a WINS server, a
remote unauthenticated user could cause the Samba server to crash or
execute arbitrary code. (CVE-2007-5398)

A heap based buffer overflow flaw was found in the way Samba
authenticates users. A remote unauthenticated user could trigger this
flaw to cause the Samba server to crash. Careful analysis of this flaw
has determined that arbitrary code execution is not possible, and
under most circumstances will not result in a crash of the Samba
server. (CVE-2007-4572)

A flaw was found in the way Samba assigned group IDs under certain
conditions. If the 'winbind nss info' parameter in smb.conf is set to
either 'sfu' or 'rfc2307', Samba users are incorrectly assigned the
group ID of 0. (CVE-2007-4138)"
  );
  # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0711&L=scientific-linux-errata&T=0&P=2863
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?62e21249"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_cwe_id(119, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/11/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Scientific Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);


flag = 0;
if (rpm_check(release:"SL3", reference:"samba-3.0.9-1.3E.14.1")) flag++;
if (rpm_check(release:"SL3", reference:"samba-client-3.0.9-1.3E.14.1")) flag++;
if (rpm_check(release:"SL3", reference:"samba-common-3.0.9-1.3E.14.1")) flag++;
if (rpm_check(release:"SL3", reference:"samba-swat-3.0.9-1.3E.14.1")) flag++;

if (rpm_check(release:"SL4", reference:"samba-3.0.25b-1.el4.2")) flag++;
if (rpm_check(release:"SL4", reference:"samba-client-3.0.25b-1.el4.2")) flag++;
if (rpm_check(release:"SL4", reference:"samba-common-3.0.25b-1.el4.2")) flag++;
if (rpm_check(release:"SL4", reference:"samba-swat-3.0.25b-1.el4.2")) flag++;

if (rpm_check(release:"SL5", reference:"samba-3.0.25b-1.el5.2")) flag++;
if (rpm_check(release:"SL5", reference:"samba-client-3.0.25b-1.el5.2")) flag++;
if (rpm_check(release:"SL5", reference:"samba-common-3.0.25b-1.el5.2")) flag++;
if (rpm_check(release:"SL5", reference:"samba-swat-3.0.25b-1.el5.2")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");