Samba 2.0.0 <= 3.0.9 Vulnerability (CVE-2004-1154)

# SPDX-FileCopyrightText: 2021 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.150720");
  script_version("2024-06-28T15:38:46+0000");
  script_tag(name:"last_modification", value:"2024-06-28 15:38:46 +0000 (Fri, 28 Jun 2024)");
  script_tag(name:"creation_date", value:"2021-09-24 10:59:30 +0000 (Fri, 24 Sep 2021)");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");

  script_cve_id("CVE-2004-1154");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba 2.0.0 <= 3.0.9 Vulnerability (CVE-2004-1154)");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2021 Greenbone AG");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Integer overflow could lead to remote code execution (RCE).");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Remote exploitation of an integer overflow vulnerability
  in the smbd daemon included in Samba 2.0.x, Samba 2.2.x,
  and Samba 3.0.x prior to and including 3.0.9 could
  allow an attacker to cause controllable heap corruption,
  leading to execution of arbitrary commands with root
  privileges.

  Successful remote exploitation allows an attacker to
  gain root privileges on a vulnerable system. In order
  to exploit this vulnerability an attacker must possess
  credentials that allow access to a share on the Samba server.
  Unsuccessful exploitation attempts will cause the process
  serving the request to crash with signal 11, and may leave
  evidence of an attack in logs.");

  script_tag(name:"affected", value:"Samba versions 2.x and 3.0.0 through 3.0.9.");

  script_tag(name:"solution", value:"Apply the patch mentioned in the linked reference.");

  script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2004-1154.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range(version: version, test_version: "2.0.0", test_version2: "3.0.9")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "Apply patch", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);