Samba Unspecified Vulnerability (CVE-2021-3670)

# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.113941");
  script_version("2024-06-26T05:05:39+0000");
  script_tag(name:"last_modification", value:"2024-06-26 05:05:39 +0000 (Wed, 26 Jun 2024)");
  script_tag(name:"creation_date", value:"2022-04-25 07:22:35 +0000 (Mon, 25 Apr 2022)");
  script_tag(name:"cvss_base", value:"6.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2022-08-29 18:12:00 +0000 (Mon, 29 Aug 2022)");

  script_cve_id("CVE-2021-3670");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba Unspecified Vulnerability (CVE-2021-3670)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2022 Greenbone AG");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Samba is prone to an unspecified vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"LDAP search filters can be very complex, search filters are not
  limited to indexed attributes and they can also include complex extended match rules like
  LDAP_MATCHING_RULE_IN_CHAIN.

  The LDAP Policy setting 'lDAPAdminLimits: MaxQueryDuration=120' (by default) should have provided
  a generous upper bound, however the policy was previously not considered in setting the timeout.

  Additionally, no interruption points were set in the filter handling to check if the operation was
  over-time.");

  script_tag(name:"affected", value:"Samba version 4.1.0 through 4.14.12 and 4.15.x through
  4.15.5.");

  script_tag(name:"solution", value:"Update to version 4.14.13, 4.15.6 or later.");

  script_xref(name:"URL", value:"https://bugzilla.samba.org/show_bug.cgi?id=14694");
  script_xref(name:"URL", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2077533");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range_exclusive(version: version, test_version_lo: "4.1.0", test_version_up: "4.14.13")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.14.13", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "4.15.0", test_version_up: "4.15.6")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.15.6", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);