Security update for samba (moderate)

openSUSE Security Update: Security update for samba Announcement ID: openSUSE-SU-2019:1292-1 Rating: moderate References: 1099590 1123755 1124223 1127153 1131060 Cross-References: CVE-2019-3880 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has four fixes is now...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2019:1037-1)

This update for samba fixes the following issues : Security issue fixed : CVE-2019-3880: Fixed a path/symlink traversal vulnerability, which allowed an unprivileged user to save registry files outside a share bsc1131060. Non-security issues fixed: Fix vfsceph ftruncate and fallocate handling...

Authentication flaw

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through varexpand to perform %variable expansion. Sending specially crafted %variable fields could result in...

DEBIAN-CVE-2017-2669

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through varexpand to perform %variable expansion. Sending specially crafted %variable fields could result in...

Fedora 26 : 1:dovecot (2017-e8b639c286)

quota: Add plugin quotamaxmailsize setting to limit the maximum individual mail size that can be saved. + imapc: Add imapcfeatures=delay-login. If set, connecting to the remote IMAP server isn't done until it's necessary. + imapc: Add imapcconnectionretrycount and imapcconnectionretryinterval...

FreeBSD : dovecot -- Dovecot DoS when passdb dict was used for authentication (a8c8001b-216c-11e7-80aa-005056925db4)

Timo Sirainen reports : passdb/userdb dict: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Fedora 24 : 1:dovecot (2017-da4ed58fd5)

quota: Add plugin quotamaxmailsize setting to limit the maximum individual mail size that can be saved. + imapc: Add imapcfeatures=delay-login. If set, connecting to the remote IMAP server isn't done until it's necessary. + imapc: Add imapcconnectionretrycount and imapcconnectionretryinterval...

Fedora 25 : 1:dovecot (2017-6ef28e38d6)

quota: Add plugin quotamaxmailsize setting to limit the maximum individual mail size that can be saved. + imapc: Add imapcfeatures=delay-login. If set, connecting to the remote IMAP server isn't done until it's necessary. + imapc: Add imapcconnectionretrycount and imapcconnectionretryinterval...

UBUNTU-CVE-2017-2669

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through varexpand to perform %variable expansion. Sending specially crafted %variable fields could result in...

cics-user-enum NSE Script

CICS User ID enumeration script for the CESL/CESN Login screen. Script Arguments cics-user-enum.commands Commands in a semi-colon separated list needed to access CICS. Defaults to CICS. idlist Path to list of transaction IDs. Defaults to the list of CICS transactions from IBM...

tso-brute NSE Script

TSO account brute forcer. This script relies on the NSE TN3270 library which emulates a TN3270 screen for NMAP. TSO user IDs have the following rules: - it cannot begin with a number - only contains alpha-numeric characters and @, , $. - it cannot be longer than 7 chars Script Arguments...

dovecot -- Dovecot DoS when passdb dict was used for authentication

Timo Sirainen reports: passdb/userdb dict: Don't double-expand %variables in keys. If dict was used as the authentication passdb, using specially crafted %variables in the username could be used to cause DoS...

ipmi-brute NSE Script

Performs brute force password auditing against IPMI RPC server. Script Arguments brute.credfile, brute.delay, brute.emptypass, brute.firstonly, brute.guesses, brute.mode, brute.passonly, brute.retries, brute.start, brute.threads, brute.unique, brute.useraspass See the documentation for the brute...

ssh-brute NSE Script

Performs brute-force password guessing against ssh servers. Script Arguments ssh-brute.timeout Connection timeout default: "5s" brute.credfile, brute.delay, brute.emptypass, brute.firstonly, brute.guesses, brute.mode, brute.passonly, brute.retries, brute.start, brute.threads, brute.unique,...

Nmap NSE 6.01: smb-brute

Attempts to guess username/password combinations over SMB, storing discovered combinations for use in other scripts. Every attempt will be made to get a valid list of users and to verify each username before actually using them. When a username is discovered, besides being printed, it is also sav...

rexec-brute NSE Script

Performs brute force password auditing against the classic UNIX rexec remote exec service. Script Arguments rexec-brute.timeout socket timeout for connecting to rexec default 10s passdb, unpwdb.passlimit, unpwdb.timelimit, unpwdb.userlimit, userdb See the documentation for the unpwdb library...

Nmap NSE net: drda-brute

Performs password guessing against databases supporting the IBM DB2 protocol such as Informix, DB2 and Derby SYNTAX: userdb: The filename of an alternate username database. drda-brute.threads: the amount of accounts to attempt to brute force in parallel default 10. unpwdb.userlimit: The maximum...

citrix-brute-xml NSE Script

Attempts to guess valid credentials for the Citrix PN Web Agent XML Service. The XML service authenticates against the local Windows server or the Active Directory. This script makes no attempt of preventing account lockout. If the password list contains more passwords than the lockout-threshold...

Mandriva Update for samba MDKA-2007:001 (samba)

Check for the Version of samba OpenVAS Vulnerability Test Mandriva Update for samba MDKA-2007:001 samba Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

GLSA-200407-21 : Samba: Multiple buffer overflows

The remote host is affected by the vulnerability described in GLSA-200407-21 Samba: Multiple buffer overflows Evgeny Demidov found a buffer overflow in SWAT, located in the base64 data decoder used to handle HTTP basic authentication CAN-2004-0600. The same flaw is present in the code used to...