Samba Security Vulnerability (CVE-2019-10218)

# Copyright (C) 2021 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.117772");
  script_version("2021-12-03T14:28:28+0000");
  script_tag(name:"last_modification", value:"2021-12-03 14:28:28 +0000 (Fri, 03 Dec 2021)");
  script_tag(name:"creation_date", value:"2021-11-11 06:48:14 +0000 (Thu, 11 Nov 2021)");
  script_tag(name:"cvss_base", value:"4.3");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2021-05-29 13:15:00 +0000 (Sat, 29 May 2021)");

  script_cve_id("CVE-2019-10218");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba Security Vulnerability (CVE-2019-10218)");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2021 Greenbone Networks GmbH");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Malicious servers can cause Samba client code to return
  filenames containing path separators to calling code.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Samba client code (libsmbclient) returns server-supplied
  filenames to calling code without checking for pathname separators (such as '/' or '../') in the
  server returned names.

  A malicious server can craft a pathname containing separators and return this to client code,
  causing the client to use this access local pathnames for reading or writing instead of SMB
  network pathnames.

  This access is done using the local privileges of the client.

  This attack can be achieved using any of SMB1/2/3 as it is not reliant on any specific SMB
  protocol version.

  Specifically, samba client tools like smbget and smbclient's mget use the server supplied 'final'
  name component as a local name when obtaining multiple files. While the design of these tools is
  that server can always choose the file names, this vulnerability is that it allows a remote server
  to create local files outside the current working directory.

  Users of the libsmbclient library external to Samba may also be vulnerable if they use server
  returned filenames without adequate checking and pass them to functions that do local filesystem
  access.

  Note that the Gnome GVFS client library is not believed to be vulnerable, as it always passes
  server-returned pathnames back to the SMB share they were returned from. Such malformed pathnames
  are then rejected by the server.");

  script_tag(name:"affected", value:"Samba versions prior to 4.9.15, 4.10.x through 4.10.9 and
  4.11.x through 4.11.1.

  Note: This flaw affects the client code (libsmbclient) of the remote Samba server installation.");

  script_tag(name:"solution", value:"Update to version 4.9.15, 4.10.10, 4.11.2 or later.");

  script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2019-10218.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "4.9.15")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.9.15", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "4.10.0", test_version2: "4.10.9")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.10.10", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "4.11.0", test_version2: "4.11.1")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.11.2", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);