Samba 3.0.25 <= 3.0.25c Vulnerability (CVE-2007-4138)

# Copyright (C) 2021 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.150726");
  script_version("2021-09-29T04:35:02+0000");
  script_tag(name:"last_modification", value:"2021-09-29 04:35:02 +0000 (Wed, 29 Sep 2021)");
  script_tag(name:"creation_date", value:"2021-09-24 10:59:30 +0000 (Fri, 24 Sep 2021)");
  script_tag(name:"cvss_base", value:"6.9");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:M/Au:N/C:C/I:C/A:C");

  script_cve_id("CVE-2007-4138");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba 3.0.25 <= 3.0.25c Vulnerability (CVE-2007-4138)");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2021 Greenbone Networks GmbH");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Incorrect primary group assignment domain users using the
  rfc2307 or sfu winbind nss info plugin.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The idmap_ad.so library provides an nss_info extension to Winbind
  for retrieving a user's home directory path, login shell and
  primary group id from an Active Directory domain controller.  This
  functionality is enabled by defining the 'winbind nss info'
  smb.conf option to either 'sfu' or 'rfc2307'.

  Both the Windows 'Identity Management for Unix' and 'Services for
  Unix' MMC plug-ins allow a user to be assigned a primary group
  for Unix clients that differs from the user's Windows primary group.
  When the rfc2307 or sfu nss_info plugin has been enabled, in
  the absence of either the RFC2307 or SFU primary group attribute,
  Winbind will assign a primary group ID of 0 to the domain user
  queried using the getpwnam() C library call.");

  script_tag(name:"affected", value:"Samba versions 3.0.25 through 3.0.25c.");

  script_tag(name:"solution", value:"Update to version 3.0.26 or later.");

  script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2007-4138.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range(version: version, test_version: "3.0.25", test_version2: "3.0.25c")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.0.26", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);