| Beschreibung: | Summary:
The remote host is missing an update for the 'samba'
package(s) announced via the referenced advisory.
Vulnerability Insight:
samba was updated to version 4.2.4 to fix 14 security issues.
These security issues were fixed:
- CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM
attacks (bsc#936862).
- CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP
authentication (bsc#973031).
- CVE-2016-2111: Domain controller netlogon member computer could have
been spoofed (bsc#973032).
- CVE-2016-2112: LDAP connenctions were vulnerable to downgrade and MITM
attack (bsc#973033).
- CVE-2016-2113: TLS certificate validation were missing (bsc#973034).
- CVE-2016-2115: Named pipe IPC were vulnerable to MITM attacks
(bsc#973036).
- CVE-2016-2118:'Badlock' DCERPC impersonation of authenticated account
were possible (bsc#971965).
- CVE-2015-3223: Malicious request can cause Samba LDAP server to hang,
spinning using CPU (boo#958581).
- CVE-2015-5330: Remote read memory exploit in LDB (boo#958586).
- CVE-2015-5252: Insufficient symlink verification (file access outside
the share)(boo#958582).
- CVE-2015-5296: No man in the middle protection when forcing smb
encryption on the client side (boo#958584).
- CVE-2015-5299: Currently the snapshot browsing is not secure through
windows previous version (shadow_copy2) (boo#958583).
- CVE-2015-8467: Fix Microsoft MS15-096 to prevent machine accounts from
being changed into user accounts (boo#958585).
- CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change
permissions on link target (boo#968222).
These non-security issues were fixed:
- Fix samba.tests.messaging test and prevent potential tdb corruption by
removing obsolete now invalid tdb_close call (boo#974629).
- Align fsrvp feature sources with upstream version.
- Obsolete libsmbsharemodes0 from samba-libs and libsmbsharemodes-devel
from samba-core-devel (boo#973832).
- s3:utils/smbget: Fix recursive download (bso#6482).
- s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem
with no ACL support (bso#10489).
- docs: Add example for domain logins to smbspool man page (bso#11643).
- s3-client: Add a KRB5 wrapper for smbspool (bso#11690).
- loadparm: Fix memory leak issue (bso#11708).
- lib/tsocket: Work around sockets not supporting FIONREAD (bso#11714).
- ctdb-scripts: Drop use of 'smbcontrol winbindd ip-dropped ...'
(bso#11719).
- s3:smbd:open: Skip redundant call to file_set_dosmode when creating a
new file (bso#11727).
- param: Fix str_list_v3 to accept ' ' again (bso#11732).
- Real memory leak(buildup) issue in loadparm (bso#11740).
- Obsolete libsmbclient from libsmbcl ...
Description truncated, please see the referenced URL(s) for more information.
Affected Software/OS:
samba on openSUSE 13.2
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
