SUSE-SU-2018:2329-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2018:2329-1

MEDIUM5.9

Security update for samba

Published Aug 14, 2018

Modified 7 years ago

Fix available

Details

Description of the patch:

This update for samba fixes the following issues:

The following security issues were fixed:

CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient (bsc#1103411).

The following other bugs were fixed:

s3:winbindd: allow a fallback to NTLMSSP for LDAP connections (bsc#1079449)

Affected Packages(32 packages)

libldb-devel

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libnetapi-devel

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libnetapi0

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libsmbclient-devel

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libsmbsharemodes-devel

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libsmbsharemodes0

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libtalloc-devel

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libtdb-devel

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libtevent-devel

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

libwbclient-devel

SUSE Linux Enterprise Desktop 11 SP4SUSE Linux Enterprise Server 11 SP4SUSE Linux Enterprise Server for SAP Applications 11 SP4SUSE Linux Enterprise Software Development Kit 11 SP4

Fixed in:

3.6.3-94.14.2

References

https://bugzilla.suse.com/1079449

https://bugzilla.suse.com/1103411

https://lists.suse.com/pipermail/sle-security-updates/2018-August/004415.html

https://www.suse.com/security/cve/CVE-2018-10858/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2018/suse-su-20182329-1/

CVSS Analysis

CVSS v3.0

5.9

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

HighI:H

Availability

NoneA:N

5.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

Upstream

Ecosystems(8)

SUSE Linux Enterprise Desktop 11 SP4 SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-LTSS SUSE Linux Enterprise Server 11 SP3-TERADATA

Timeline

PublishedAug 14, 2018

ModifiedAug 14, 2018