Lucene search

K
slackwareSlackware Linux ProjectSSA-2017-082-02
HistoryMar 24, 2017 - 5:44 a.m.

[slackware-security] samba

2017-03-2405:44:58
Slackware Linux Project
www.slackware.com
15

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.017 Low

EPSS

Percentile

87.4%

New samba packages are available for Slackware 14.0, 14.1, 14.2, and -current
to fix a security issue.

Here are the details from the Slackware 14.2 ChangeLog:

patches/packages/samba-4.4.12-i586-1_slack14.2.txz: Upgraded.
This update fixes a security issue:
All versions of Samba prior to 4.6.1, 4.5.7, 4.4.12 are vulnerable to
a malicious client using a symlink race to allow access to areas of
the server file system not exported under the share definition.
For more information, see:
https://vulners.com/cve/CVE-2017-2619
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/samba-4.4.12-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/samba-4.4.12-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/samba-4.4.12-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/samba-4.4.12-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/samba-4.4.12-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/samba-4.4.12-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/samba-4.6.1-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/samba-4.6.1-x86_64-1.txz

MD5 signatures:

Slackware 14.0 package:
c17714e61d60e8e643bdd9bc51edafe1 samba-4.4.12-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
54bfdadaf8b7abc1242c5a71ea0a407f samba-4.4.12-x86_64-1_slack14.0.txz

Slackware 14.1 package:
500af32e09c75b7a234b4a9e05c62f5a samba-4.4.12-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
9f86969a772e06f991e9452dda584b81 samba-4.4.12-x86_64-1_slack14.1.txz

Slackware 14.2 package:
e48f91e5a15555caec1d6c4b8b3b88f7 samba-4.4.12-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
4dd6e6936de5236eef7f7b0254390b05 samba-4.4.12-x86_64-1_slack14.2.txz

Slackware -current package:
4b0c75d2b3fecc64c6ad50c3d847e839 n/samba-4.6.1-i586-1.txz

Slackware x86_64 -current package:
ff9eca50dedd7452a9f3a6f6fed43c84 n/samba-4.6.1-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg samba-4.4.12-i586-1_slack14.2.txz

Then, if Samba is running restart it:

> /etc/rc.d/rc.samba restart

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.017 Low

EPSS

Percentile

87.4%