OPENSUSE-SU-2019:2700-1 Security update for samba

This update for samba fixes the following issues: - CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name bsc1158108. - CVE-2019-14870: Fixed a DelegationNotAllowed not bein...

Security update for samba (important)

openSUSE Security Update: Security update for samba Announcement ID: openSUSE-SU-2019:2700-1 Rating: important References: 1158108 1158109 Cross-References: CVE-2019-14861 CVE-2019-14870 Affected Products: openSUSE Leap 15.1 An update that fixes two vulnerabilities is now available. Description:...

Security Bulletin: Vulnerabilities in Samba affects IBM Watson Studio Local

Summary Vulnerabilities in Samba affects IBM Watson Studio Local Vulnerability Details CVEID: CVE-2019-10197 DESCRIPTION: A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration...

samba:fuzz_ndr_nbt_TYPE_STRUCT: Heap-buffer-overflow in ndr_push_bytes

Detailed Report: https://oss-fuzz.com/testcase?key=5690460391866368 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzzndrnbtTYPESTRUCT Job Type: libfuzzerasansamba Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x608000000200 Crash State: ndrpushbytes...

Security Bulletin: SMB signing not required in IBM Spectrum Protect Plus (CVE-2016-2115)

Summary IBM Spectrum Protect Plus is vulnerable to man-in-the-middle attacks as it does not make SMB signing mandatory. Vulnerability Details CVEID: CVE-2016-2115 DESCRIPTION: Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC...

Amazon Linux AMI : samba (ALAS-2019-1329)

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. CVE-2019-388...

MGASA-2019-0397 Updated samba packages fix security vulnerabilities

Updated samba packages fix security vulnerabilities: Malicious servers can cause Samba client code to return filenames containing path separators to calling code CVE-2019-10218. When the password contains multi-byte non-ASCII characters, the check password script does not receive the full passwor...

Updated samba packages fix security vulnerabilities

Updated samba packages fix security vulnerabilities: Malicious servers can cause Samba client code to return filenames containing path separators to calling code CVE-2019-10218. When the password contains multi-byte non-ASCII characters, the check password script does not receive the full passwor...

samba:fuzz_ndr_witness_TYPE_STRUCT: Heap-buffer-overflow in ndr_push_witness_IPaddrInfo

Detailed Report: https://oss-fuzz.com/testcase?key=5645239016751104 Project: samba Fuzzing Engine: libFuzzer Fuzz Target: fuzzndrwitnessTYPESTRUCT Job Type: libfuzzerasansamba Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x608000000100 Crash State:...

Security Bulletin: Multiple Vulnerabilities in Samba affect IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-15275 DESCRIPTION: Samba could allow a remote attacker to obtain sensitive information, caused by a heap memory information leak. By sending a specially crafted request, an attacker...

Security Bulletin: Vulnerability CVE-2017-7494 in Samba affects IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-7494 DESCRIPTION: Samba could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper access to named pipe endpoints. By uploading a...

Security Bulletin: Vulnerability CVE-2017-2619 in Samba affects IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-2619 DESCRIPTION: Samba could allow a remote authenticated attacker to launch a symlink attack, caused by a race condition A local attacker could exploit this vulnerability using SM...

Security Bulletin: Multiple vulnerabilities in Samba, including Badlock, affect IBM i

Summary Samba vulnerabilities were disclosed on April 12, 2016. Samba is used by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2118 DESCRIPTION: Samba could allow a remote attacker to gain elevated privileges on the system, caused by the acceptance of...

Security Bulletin: Vulnerabilities CVE-2017-12150, CVE-2017-12151 and CVE-2017-12163 in Samba affect IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-12163 DESCRIPTION: Samba could allow a remote authenticated attacker to obtain sensitive information, caused by a memory leak over SMB1. By sending specially crafted SMB1 data, an...

Security Bulletin: Vulnerabilities in Samba affect IBM i

Summary Security vulnerabilities in Samba affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-7560 DESCRIPTION: Samba could allow a remote authenticated attacker to launch a symlink attack. By creating a symbolic link to a file or directory using SMB1 UNIX...

Security Bulletin: Multiple Vulnerabilities in Samba affect IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-10918 DESCRIPTION: Samba is vulnerable to a denial of service, caused by a NULL pointer dereference when checking database outputs from the LDB database layer. If Samba is in an...

Security Bulletin: Vulnerabilities in Samba affect IBM i

Summary Security vulnerabilities in Samba affect IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-3223 DESCRIPTION: Samba is vulnerable to a denial of service, caused by an error in the daemon LDAP server. By sending specially crafted packets, an attacker coul...

Security Bulletin: Multiple Vulnerabilities in Samba affect IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-1050 DESCRIPTION: Samba is vulnerable to a denial of service, caused by missing null pointer checks on some of the input parameters. By sending specially RPC calls to the ''spoolss'...

Security fix for the ALT Linux 8 package samba version 4.9.17-alt1

4.9.17-alt1 built Dec. 18, 2019 Evgeny Sinelnikov in task 242978 Dec. 13, 2019 Evgeny Sinelnikov - Update to last security winter release - Security fixes: + CVE-2019-14861: Samba AD DC zone-named record Denial of Service in DNS management server + CVE-2019-14870: DelegationNotAllowed not being...

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2019:3319-1)

This update for samba fixes the following issues : CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name bsc1158108. CVE-2019-14870: Fixed a DelegationNotAllowed not being...