CentOS ProjectCESA-2016:1486ctdb, libsmbclient, libwbclient, samba security update
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
76.5%
CentOS Errata and Security Advisory CESA-2016:1486
Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.
Security Fix(es):
- A flaw was found in the way Samba initiated signed DCE/RPC connections. A
man-in-the-middle attacker could use this flaw to downgrade the connection to not use signing and therefore impersonate the server. (CVE-2016-2119)
Red Hat would like to thank the Samba project for reporting this issue. Upstream acknowledges Stefan Metzmacher as the original reporter.
Bug Fix(es):
-
Previously, the “net” command in some cases failed to join the client to Active Directory (AD) because the permissions setting prevented modification of the supported Kerberos encryption type LDAP attribute. With this update, Samba has been fixed to allow joining an AD domain as a user. In addition, Samba now uses the machine account credentials to set up the Kerberos encryption types within AD for the joined machine. As a result, using “net” to join a domain now works more reliably. (BZ#1351260)
-
Previously, the idmap_hash module worked incorrectly when it was used together with other modules. As a consequence, user and group IDs were not mapped properly. A patch has been applied to skip already configured modules. Now, the hash module can be used as the default idmap configuration back end and IDs are resolved correctly. (BZ#1350759)
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2016-July/084155.html
https://lists.centos.org/pipermail/centos-announce/2016-July/096910.html
Affected packages:
ctdb
ctdb-devel
ctdb-tests
libsmbclient
libsmbclient-devel
libwbclient
libwbclient-devel
samba
samba-client
samba-client-libs
samba-common
samba-common-libs
samba-common-tools
samba-dc
samba-dc-libs
samba-devel
samba-libs
samba-pidl
samba-python
samba-test
samba-test-devel
samba-test-libs
samba-vfs-glusterfs
samba-winbind
samba-winbind-clients
samba-winbind-krb5-locator
samba-winbind-modules
Upstream details at:
https://access.redhat.com/errata/RHSA-2016:1486
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| CentOS | 7 | x86_64 | ctdb | < 4.2.10-7.el7_2 | ctdb-4.2.10-7.el7_2.x86_64.rpm |
| CentOS | 7 | i686 | ctdb-devel | < 4.2.10-7.el7_2 | ctdb-devel-4.2.10-7.el7_2.i686.rpm |
| CentOS | 7 | x86_64 | ctdb-devel | < 4.2.10-7.el7_2 | ctdb-devel-4.2.10-7.el7_2.x86_64.rpm |
| CentOS | 7 | x86_64 | ctdb-tests | < 4.2.10-7.el7_2 | ctdb-tests-4.2.10-7.el7_2.x86_64.rpm |
| CentOS | 7 | i686 | libsmbclient | < 4.2.10-7.el7_2 | libsmbclient-4.2.10-7.el7_2.i686.rpm |
| CentOS | 7 | x86_64 | libsmbclient | < 4.2.10-7.el7_2 | libsmbclient-4.2.10-7.el7_2.x86_64.rpm |
| CentOS | 7 | i686 | libsmbclient-devel | < 4.2.10-7.el7_2 | libsmbclient-devel-4.2.10-7.el7_2.i686.rpm |
| CentOS | 7 | x86_64 | libsmbclient-devel | < 4.2.10-7.el7_2 | libsmbclient-devel-4.2.10-7.el7_2.x86_64.rpm |
| CentOS | 7 | i686 | libwbclient | < 4.2.10-7.el7_2 | libwbclient-4.2.10-7.el7_2.i686.rpm |
| CentOS | 7 | x86_64 | libwbclient | < 4.2.10-7.el7_2 | libwbclient-4.2.10-7.el7_2.x86_64.rpm |
Related
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
0.005 Low
EPSS
Percentile
76.5%