SUSE-RU-2016:1479-1

MEDIUM5.9

Recommended update for samba

Published Jun 2, 2016

Modified 10 years ago

Fix available

Details

Description of the patch:

This update for Samba provides the following fixes:

Fix libads' record session expiry for spnego sasl binds. (bsc#979268)
Fix NT_STATUS_ACCESS_DENIED when accessing windows public share.
Only validate MIC if 'map to guest' is not being used.
NetAPP SMB servers don't negotiate NTLMSSP_SIGN. (bsc#977669)
Fix non-working anonymous smb connections.
Handle broken mechListMIC response from Windows 2000.
wbinfo -u or net ads search doesn't work anymore.
Fix regressions regarding the NTLMSSP hardening of CVE-2016-2110.
Allow Domain member resolve trusted domains' users.

Affected Packages(77 packages)

libdcerpc-binding0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libdcerpc-binding0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libdcerpc0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libdcerpc0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libgensec0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libgensec0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libndr-krb5pac0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libndr-krb5pac0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libndr-nbt0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

libndr-nbt0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-19.1

References

https://bugzilla.suse.com/977669

https://bugzilla.suse.com/979268

https://lists.suse.com/pipermail/sle-updates/2016-June/004725.html

https://www.suse.com/security/cve/CVE-2016-2110/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement//suse-ru-20161479-1/

CVSS Analysis

CVSS v3.0

5.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

HighI:H

Availability

NoneA:N

5.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Upstream

Ecosystems

SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise High Availability Extension 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1

Timeline

PublishedJun 2, 2016

ModifiedJun 2, 2016

SUSE-RU-2016:1479-1 | Mondoo Vulnerability Intelligence