Samba 3.0.0 <= 3.6.3 Remote Code Execution Vulnerability (CVE-2012-1182)

# SPDX-FileCopyrightText: 2021 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.150729");
  script_version("2024-06-28T15:38:46+0000");
  script_tag(name:"last_modification", value:"2024-06-28 15:38:46 +0000 (Fri, 28 Jun 2024)");
  script_tag(name:"creation_date", value:"2021-09-24 10:59:30 +0000 (Fri, 24 Sep 2021)");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");

  script_cve_id("CVE-2012-1182");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba 3.0.0 <= 3.6.3 Remote Code Execution Vulnerability (CVE-2012-1182)");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2021 Greenbone AG");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Samba 3.0.x to 3.6.3 are affected by a vulnerability that allows
  remote code execution (RCE) as the 'root' user.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Samba versions 3.6.3 and all versions previous to this are affected by
  a vulnerability that allows remote code execution as the 'root' user
  from an anonymous connection.

  The code generator for Samba's remote procedure call (RPC) code
  contained an error which caused it to generate code containing a
  security flaw. This generated code is used in the parts of Samba that
  control marshalling and unmarshalling of RPC calls over the network.

  The flaw caused checks on the variable containing the length of an
  allocated array to be done independently from the checks on the
  variable used to allocate the memory for that array.  As both these
  variables are controlled by the connecting client it makes it possible
  for a specially crafted RPC call to cause the server to execute
  arbitrary code.

  As this does not require an authenticated connection it is the most
  serious vulnerability possible in a program, and users and vendors are
  encouraged to patch their Samba installations immediately.");

  script_tag(name:"affected", value:"Samba versions 3.0.0 through 3.6.3.");

  script_tag(name:"solution", value:"Update to version 3.4.16, 3.5.14, 3.6.4 or later.");

  script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2012-1182.html");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range(version: version, test_version: "3.0.0", test_version2: "3.4.15")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.4.16", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "3.5.0", test_version2: "3.5.13")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.5.14", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "3.6.0", test_version2: "3.6.3")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.6.4", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);