Security fix for the ALT Linux 10 package samba version 4.11.8-alt1

April 28, 2020 Evgeny Sinelnikov 4.11.8-alt1 - Update to latest stable security release of the Samba 4.11 - Security fixes: + CVE-2020-10700: Fix use-after-free in AD DC LDAP server when ASQ and pagedresults combined + CVE-2020-10704: Fix LDAP Denial of Service stack overflow in Samba AD DC...

CVE-2020-10700

A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before...

Samba Releases Security Updates

The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. An attacker could exploit one of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to...

CVE-2020-10704

A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerabilit...

Use-after-free in Samba AD DC LDAP Server with ASQ

Description Samba has, since Samba 4.0, supported the Paged Results LDAP feature, to allow clients to obtain pages of search results against a Samba AD DC using an LDAP control. Since Samba 4.7.11 and 4.8.6 a Denial of Service prevention has been in place in this module, to age out old client...

UBUNTU-CVE-2020-10700

A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before...

UBUNTU-CVE-2020-10704

A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerabilit...

Scientific Linux Security Update : samba on SL7.x x86_64 (20200407)

samba: Combination of parameters and permissions can allow user to escape from the share path definition samba: smb client vulnerable to filenames containing path separators C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2020-1511)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : samba (EulerOS-SA-2020-1511)

According to the version of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and all samba 4.11.x versions...

Arbitrary Code Execution

samba is vulnerable to arbitrary code execution. The vulnerability exist as an input validation flaw was found in the way Samba handled Any Batched AndX requests. A remote, unauthenticated attacker could send a specially-crafted SMB packet to the Samba server, possibly resulting in arbitrary code...

Information Disclosure

samba is vulnerable to information disclosure. The vulnerability exists as the default Samba server configuration enabled both the "wide links" and "unix extensions" options, allowing Samba clients with write access to a share to create symbolic links that point to any location on the file system...

Denial Of Service (DoS)

samba is vulnerable to denial of service. It was found that the fix for CVE-2010-0547, provided by the Samba rebase in RHBA-2011:0054, was incomplete. The mount.cifs tool did not properly handle share or directory names containing a newline character, allowing a local attacker to corrupt the mtab...

Cross-Site Scripting (XSS)

samba is vulnerable to cross-site scripting XSS. A cross-site scripting XSS flaw was found in the password change page of the Samba Web Administration Tool SWAT. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, it would lead t...

Cross-Site Request Forgery (CSRF)

samba is vulnerable to cross-site request forgery CSRF. It was found that SWAT web pages did not protect against Cross-Site Request Forgery CSRF attacks. If a remote attacker could trick a user, who was logged into the SWAT interface, into visiting a specially-crafted URL, the attacker could...

Insecure Resource Limit Verification

samba does not properly verify resource limits. It was found that the mount.cifs tool did not handle certain errors correctly when updating the mtab file. If mount.cifs had the setuid bit set, a local attacker could corrupt the mtab file by setting a small file size limit before running mount.cif...

Denial Of Service (DoS)

samba is vulnerable to denial of service. A flaw was found in the way Samba handled file descriptors. If an attacker were able to open a large number of file descriptors on the Samba server, they could flip certain stack bits to "1" values, resulting in the Samba server smbd crashing...

Symlink Attack

samba is vulnerable to symlink attack. Local users are able to mount a CIFS share on an arbitrary mountpoint using symlinks on the mountpoint directory file to gain additional privileges...

Denial Of Service (DoS)

samba is vulnerable to denial of service. The application does not verify device name and mountpoint strings, allowing local users to crash the application via a malicious string...

Denial Of Service (DoS)

Samba vulnerable to Denial Of Service DoS. Due to an input sanitization flaw in the way Samba parsed client data, a malicious client could send a specially-crafted SMB packet to the Samba server, resulting in arbitrary code execution with the privileges of the Samba server smbd...