SUSE-SU-2019:3318-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2019:3318-1

MEDIUM5.4

Security update for samba

Published Dec 17, 2019

Modified 6 years ago

Fix available

Details

Description of the patch:

This update for samba fixes the following issues:

CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name (bsc#1158108).
CVE-2019-14870: Fixed a DelegationNotAllowed not being enforced (bsc#1158109).

Affected Packages(67 packages)

ctdb

SUSE Linux Enterprise High Availability Extension 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libdcerpc-binding0

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libdcerpc-binding0-32bit

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libdcerpc-devel

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libdcerpc-samr-devel

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libdcerpc-samr0

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libdcerpc0

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libdcerpc0-32bit

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libndr-devel

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

libndr-krb5pac-devel

SUSE Linux Enterprise Module for Basesystem 15

Fixed in:

4.7.11+git.202.6edee83fb34-4.34.1

References

https://bugzilla.suse.com/1158108

https://bugzilla.suse.com/1158109

https://www.suse.com/security/cve/CVE-2019-14861/

https://www.suse.com/security/cve/CVE-2019-14870/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2019/suse-su-20193318-1.html

https://www.suse.com/support/update/announcement/2019/suse-su-20193318-1/

CVSS Analysis

CVSS v3.1

5.4

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

5.4/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Upstream

CVE-2019-14861 CVE-2019-14870

Ecosystems

SUSE Linux Enterprise High Availability Extension 15 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Package Hub 15

Timeline

PublishedDec 17, 2019

ModifiedDec 17, 2019