|Category:||CentOS Local Security Checks|
|Title:||CentOS Update for libsmbclient CESA-2017:2789 centos6|
|Summary:||Check the version of libsmbclient|
Check the version of libsmbclient
Samba is an open-source implementation
of the Server Message Block (SMB) protocol and the related Common Internet File
System (CIFS) protocol, which allow PC-compatible machines to share files,
printers, and various information.
* A race condition was found in samba server. A malicious samba client
could use this flaw to access files and directories in areas of the server
file system not exported under the share definitions. (CVE-2017-2619)
* It was found that samba did not enforce 'SMB signing' when certain
configuration options were enabled. A remote attacker could launch a
man-in-the-middle attack and retrieve information in plain-text.
* An information leak flaw was found in the way SMB1 protocol was
implemented by Samba. A malicious client could use this flaw to dump server
memory contents to a file on the samba share or to a shared printer, though
the exact area of server memory cannot be controlled by the attacker.
Red Hat would like to thank the Samba project for reporting CVE-2017-2619
and CVE-2017-12150 and Yihan Lian and Zhibin Hu (Qihoo 360 GearTeam),
Stefan Metzmacher (SerNet), and Jeremy Allison (Google) for reporting
CVE-2017-12163. Upstream acknowledges Jann Horn (Google) as the original
reporter of CVE-2017-2619 and Stefan Metzmacher (SerNet) as the original
reporter of CVE-2017-12150.
libsmbclient on CentOS 6
Please Install the Updated Packages.
Common Vulnerability Exposure (CVE) ID: CVE-2017-2619|
BugTraq ID: 97033
Debian Security Information: DSA-3816 (Google Search)
RedHat Security Advisories: RHSA-2017:1265
RedHat Security Advisories: RHSA-2017:2338
RedHat Security Advisories: RHSA-2017:2778
RedHat Security Advisories: RHSA-2017:2789
|Copyright||Copyright (C) 2017 Greenbone Networks GmbH|
|This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.