Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Samba vulnerabilities (USN-6425-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-6425-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(182845);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/16");

  script_cve_id(
    "CVE-2023-4091",
    "CVE-2023-4154",
    "CVE-2023-42669",
    "CVE-2023-42670"
  );
  script_xref(name:"USN", value:"6425-1");
  script_xref(name:"IAVA", value:"2023-A-0535");

  script_name(english:"Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Samba vulnerabilities (USN-6425-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple
vulnerabilities as referenced in the USN-6425-1 advisory.

  - The SMB protocol allows opening files where the client requests read-only access, but then implicitly
    truncating the opened file if the client specifies a separate OVERWRITE create disposition. This operation
    requires write access to the file, and in the default Samba configuration the operating system kernel will
    deny access to open a read-only file for read/write (which the truncate operation requires). However, when
    Samba has been configured to ignore kernel file system permissions, Samba will truncate a file when the
    underlying operating system kernel would deny the operation. Affected Samba configurations are the ones
    where kernel file-system permission checks are bypassed, relying on Samba's own permission enforcement.
    The error is that this check is done against the client request for read-only access, and not the
    implicitly requested read-write (for truncate) one. The widely used Samba VFS module acl_xattr when
    configured with the module configuration parameter acl_xattr:ignore system acls = yes is the only
    upstream Samba module that allows this behavior and is the only known method of reproducing this security
    flaw. If (as is the default) the module configuration parameter acl_xattr:ignore system acls=no, then
    the Samba server is not vulnerable to this attack. (CVE-2023-4091)

  - In normal operation, passwords and (most) secrets are never disclosed over LDAP in Active Directory.
    However, due to a design flaw in Samba's implementation of the DirSync control, Active Directory accounts
    authorized to do some replication, but not to replicate sensitive attributes, can instead replicate
    critical domain passwords and secrets. In a default installation, this means that RODC DC accounts (which
    should only be permitted to replicate some passwords) can instead obtain all domain secrets, including the
    core AD secret: the krbtgt password. RODCs are given this permission as part of their installation for DRS
    replication. This vulnerability removes the RODC / DC distinction. Secondly, and just as problematically,
    the access check for this functionality did not account for error conditions - errors like out of memory
    were regarded as success. This is sometimes described as fail open. In these error conditions, some of
    which (eg out of memory) may be influenced by a low-privileged attacker, access to the secret attributes
    could be obtained! (CVE-2023-4154)

  - Samba developers have built a non-Windows RPC server known as rpcecho to test elements of the Samba
    DCE/RPC stack under their full control. One RPC function provided by rpcecho can block, essentially
    indefinitely, and because the rpcecho service is provided from the main RPC task, which has only one
    worker, this denies essentially all service on the AD DC. To address this problem, the rpcecho server is
    removed from our production binaries and is restricted to selftest builds only. (CVE-2023-42669)

  - Samba as an Active Directory DC operates RPC services from two distinct parts of the codebase. Those
    services focused on the AD DC are started in the main samba process, while services focused on the
    fileserver and NT4-like DC are started from the new samba-dcerpcd, which is launched on-demand from the
    fileserver (smbd) tasks. When starting, samba-dcerpcd must first confirm which services not to provide, so
    as to avoid duplicate listeners. The issue in this advisory is that, when Samba's RPC server is under
    load, or otherwise not responding, the servers NOT built for the AD DC (eg build instead for the
    NT4-emulation classic DCs) can be incorrectly started, and compete to listen on the same unix domain
    sockets. This then results in some queries being answered by the AD DC, and some not. This has been seen
    in production at multiple sites, as The procedure number is out of range when starting Active Directory
    Users and Computers tool, however it can also be triggered maliciously, to prevent service on the AD DC.
    (CVE-2023-42670)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-6425-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-4154");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/10/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/10/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/10/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:23.04");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ctdb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:ldb-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libldb-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libldb2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libnss-winbind");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libpam-winbind");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libsmbclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libsmbclient-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libwbclient-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libwbclient0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-ldb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-ldb-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-samba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:registry-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-ad-dc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-ad-provision");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-common-bin");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-dev");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-dsdb-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-testsuite");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:samba-vfs-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:smbclient");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:winbind");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2023 Canonical, Inc. / NASL script (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('20.04' >< os_release || '22.04' >< os_release || '23.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 20.04 / 22.04 / 23.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);

var pkgs = [
    {'osver': '20.04', 'pkgname': 'ctdb', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'libnss-winbind', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'libpam-winbind', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'libsmbclient', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'libsmbclient-dev', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'libwbclient-dev', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'libwbclient0', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'python3-samba', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'registry-tools', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'samba', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'samba-common', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'samba-common-bin', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'samba-dev', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'samba-dsdb-modules', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'samba-libs', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'samba-testsuite', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'samba-vfs-modules', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'smbclient', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '20.04', 'pkgname': 'winbind', 'pkgver': '2:4.15.13+dfsg-0ubuntu0.20.04.6'},
    {'osver': '22.04', 'pkgname': 'ctdb', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'libnss-winbind', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'libpam-winbind', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'libsmbclient', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'libsmbclient-dev', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'libwbclient-dev', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'libwbclient0', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'python3-samba', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'registry-tools', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'samba', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'samba-common', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'samba-common-bin', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'samba-dev', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'samba-dsdb-modules', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'samba-libs', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'samba-testsuite', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'samba-vfs-modules', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'smbclient', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '22.04', 'pkgname': 'winbind', 'pkgver': '2:4.15.13+dfsg-0ubuntu1.5'},
    {'osver': '23.04', 'pkgname': 'ctdb', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'ldb-tools', 'pkgver': '2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'libldb-dev', 'pkgver': '2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'libldb2', 'pkgver': '2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'libnss-winbind', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'libpam-winbind', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'libsmbclient', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'libsmbclient-dev', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'libwbclient-dev', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'libwbclient0', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'python3-ldb', 'pkgver': '2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'python3-ldb-dev', 'pkgver': '2:2.6.2+samba4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'python3-samba', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'registry-tools', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-ad-dc', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-ad-provision', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-common', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-common-bin', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-dev', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-dsdb-modules', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-libs', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-testsuite', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'samba-vfs-modules', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'smbclient', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'},
    {'osver': '23.04', 'pkgname': 'winbind', 'pkgver': '2:4.17.7+dfsg-1ubuntu2.3'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (osver && pkgname && pkgver) {
    if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'ctdb / ldb-tools / libldb-dev / libldb2 / libnss-winbind / etc');
}