Samba Information Disclosure Vulnerability (CVE-2021-44141)

# Copyright (C) 2022 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.147555");
  script_version("2022-02-25T03:03:32+0000");
  script_tag(name:"last_modification", value:"2022-02-25 03:03:32 +0000 (Fri, 25 Feb 2022)");
  script_tag(name:"creation_date", value:"2022-02-01 05:19:49 +0000 (Tue, 01 Feb 2022)");
  script_tag(name:"cvss_base", value:"3.5");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:S/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2022-02-23 15:17:00 +0000 (Wed, 23 Feb 2022)");

  script_cve_id("CVE-2021-44141");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba Information Disclosure Vulnerability (CVE-2021-44141)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2022 Greenbone Networks GmbH");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Samba is prone to an information disclosure vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Samba is vulnerable to a malicious client using a server
  symlink to determine if a file or directory exists in an area of the server file system not
  exported under the share definition. SMB1 with unix extensions has to be enabled in order for
  this attack to succeed.

  Clients that have write access to the exported part of the file system under a share via SMB1
  unix extensions or via NFS can create symlinks that point to arbitrary files or directories on
  the server filesystem.

  Clients can then use SMB1 unix extension information queries to determine if the target of the
  symlink exists or not by examining error codes returned from the smbd server. There is no ability
  to access these files or directories, only to determine if they exist or not.

  If SMB1 is turned off and only SMB2 is used, or unix extensions are not enabled then there is no
  way to discover if a symlink points to a valid target or not via SMB2. For this reason, even if
  symlinks are created via NFS, if the Samba server does not allow SMB1 with unix extensions there
  is no way to exploit this bug.

  Finding out what files or directories exist on a file server can help attackers guess system user
  names or the exact operating system release and applications running on the server hosting Samba
  which may help mount further attacks.

  SMB1 has been disabled on Samba since version 4.11.0 and onwards.");

  script_tag(name:"affected", value:"Samba versions prior to 4.15.5.");

  script_tag(name:"solution", value:"Update to version 4.15.5 or later.");

  script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2021-44141.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "4.15.5")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.15.5", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);