Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64

2012-08-01T00:00:00
ID SL_20071115_SAMBA_ON_SL5_X.NASL
Type nessus
Reporter Tenable
Modified 2016-12-14T00:00:00

Description

A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398)

A heap based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572)

A flaw was found in the way Samba assigned group IDs under certain conditions. If the 'winbind nss info' parameter in smb.conf is set to either 'sfu' or 'rfc2307', Samba users are incorrectly assigned the group ID of 0. (CVE-2007-4138)

                                        
                                            #
# (C) Tenable Network Security, Inc.
#
# The descriptive text is (C) Scientific Linux.
#

include("compat.inc");

if (description)
{
  script_id(60309);
  script_version("$Revision: 1.2 $");
  script_cvs_date("$Date: 2016/12/14 20:22:12 $");

  script_cve_id("CVE-2007-4138", "CVE-2007-4572", "CVE-2007-5398");

  script_name(english:"Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Scientific Linux host is missing one or more security
updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"A buffer overflow flaw was found in the way Samba creates NetBIOS
replies. If a Samba server is configured to run as a WINS server, a
remote unauthenticated user could cause the Samba server to crash or
execute arbitrary code. (CVE-2007-5398)

A heap based buffer overflow flaw was found in the way Samba
authenticates users. A remote unauthenticated user could trigger this
flaw to cause the Samba server to crash. Careful analysis of this flaw
has determined that arbitrary code execution is not possible, and
under most circumstances will not result in a crash of the Samba
server. (CVE-2007-4572)

A flaw was found in the way Samba assigned group IDs under certain
conditions. If the 'winbind nss info' parameter in smb.conf is set to
either 'sfu' or 'rfc2307', Samba users are incorrectly assigned the
group ID of 0. (CVE-2007-4138)"
  );
  # http://listserv.fnal.gov/scripts/wa.exe?A2=ind0711&L=scientific-linux-errata&T=0&P=2863
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?80df3cc8"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_cwe_id(119, 264);

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2007/11/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2016 Tenable Network Security, Inc.");
  script_family(english:"Scientific Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);


flag = 0;
if (rpm_check(release:"SL3", reference:"samba-3.0.9-1.3E.14.1")) flag++;
if (rpm_check(release:"SL3", reference:"samba-client-3.0.9-1.3E.14.1")) flag++;
if (rpm_check(release:"SL3", reference:"samba-common-3.0.9-1.3E.14.1")) flag++;
if (rpm_check(release:"SL3", reference:"samba-swat-3.0.9-1.3E.14.1")) flag++;

if (rpm_check(release:"SL4", reference:"samba-3.0.25b-1.el4.2")) flag++;
if (rpm_check(release:"SL4", reference:"samba-client-3.0.25b-1.el4.2")) flag++;
if (rpm_check(release:"SL4", reference:"samba-common-3.0.25b-1.el4.2")) flag++;
if (rpm_check(release:"SL4", reference:"samba-swat-3.0.25b-1.el4.2")) flag++;

if (rpm_check(release:"SL5", reference:"samba-3.0.25b-1.el5.2")) flag++;
if (rpm_check(release:"SL5", reference:"samba-client-3.0.25b-1.el5.2")) flag++;
if (rpm_check(release:"SL5", reference:"samba-common-3.0.25b-1.el5.2")) flag++;
if (rpm_check(release:"SL5", reference:"samba-swat-3.0.25b-1.el5.2")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");