SUSE-SU-2016:2306-1

HIGH7.5

Security update for samba

Published Sep 14, 2016

Modified 9 years ago

Fix available

Details

Description of the patch:

This update for samba provides the following fixes:

CVE-2016-2119: Prevent client-side SMB2 signing downgrade. (bsc#986869)
Fix possible ctdb crash when opening sockets with htons(IPPROTO_RAW). (bsc#969522)
Honor smb.conf socket options in winbind. (bsc#975131)
Fix ntlm-auth segmentation fault with squid. (bsc#986228)
Implement new '--no-dns-updates' option in 'net ads' command. (bsc#991564)
Fix population of ctdb sysconfig after source merge. (bsc#981566)

Affected Packages(77 packages)

libdcerpc-binding0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libdcerpc-binding0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libdcerpc0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libdcerpc0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libgensec0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libgensec0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libndr-krb5pac0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libndr-krb5pac0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libndr-nbt0

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

libndr-nbt0-32bit

SUSE Linux Enterprise Desktop 12 SP1SUSE Linux Enterprise Server 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

4.2.4-26.2

References

https://bugzilla.suse.com/969522

https://bugzilla.suse.com/975131

https://bugzilla.suse.com/981566

https://bugzilla.suse.com/986228

https://bugzilla.suse.com/986869

https://bugzilla.suse.com/991564

https://lists.suse.com/pipermail/sle-security-updates/2016-September/002273.html

https://www.suse.com/security/cve/CVE-2016-2119/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2016/suse-su-20162306-1/

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Upstream

Ecosystems

SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise High Availability Extension 12 SP1 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP1

Timeline

PublishedSep 14, 2016

ModifiedSep 14, 2016

SUSE-SU-2016:2306-1 | Mondoo Vulnerability Intelligence