openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:1025-1 Rating: important References: #924519 #936862 #968973 #971965 #972197 #973031 #973032 #973033 #973034 #973036 #973832 #974629 Cross-References: CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2115 CVE-2016-2118 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has 5 fixes is now available. Description: samba was updated to fix seven security issues. These security issues were fixed: - CVE-2015-5370: DCERPC server and client were vulnerable to DOS and MITM attacks (bsc#936862). - CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication (bsc#973031). - CVE-2016-2111: Domain controller netlogon member computer could have been spoofed (bsc#973032). - CVE-2016-2112: LDAP conenctions were vulnerable to downgrade and MITM attack (bsc#973033). - CVE-2016-2113: TLS certificate validation were missing (bsc#973034). - CVE-2016-2115: Named pipe IPC were vulnerable to MITM attacks (bsc#973036). - CVE-2016-2118: "Badlock" DCERPC impersonation of authenticated account were possible (bsc#971965). These non-security issues were fixed: - bsc#974629: Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call. - bsc#973832: Obsolete libsmbsharemodes0 from samba-libs and libsmbsharemodes-devel from samba-core-devel. - bsc#972197: Obsolete libsmbclient from libsmbclient0 and libpdb-devel from libsamba-passdb-devel while not providing it. - Getting and setting Windows ACLs on symlinks can change permissions on link - bsc#924519: Upgrade on-disk FSRVP server state to new version. - bsc#968973: Only obsolete but do not provide gplv2/3 package names. - bso#6482: s3:utils/smbget: Fix recursive download. - bso#10489: s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support. - bso#11643: docs: Add example for domain logins to smbspool man page. - bso#11690: s3-client: Add a KRB5 wrapper for smbspool. - bso#11708: loadparm: Fix memory leak issue. - bso#11714: lib/tsocket: Work around sockets not supporting FIONREAD. - bso#11719: ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ...". - bso#11727: s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file. - bso#11732: param: Fix str_list_v3 to accept ";" again. - bso#11740: Real memeory leak(buildup) issue in loadparm. This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-453=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ctdb-4.2.4-15.1 ctdb-debuginfo-4.2.4-15.1 ctdb-devel-4.2.4-15.1 ctdb-tests-4.2.4-15.1 ctdb-tests-debuginfo-4.2.4-15.1 libdcerpc-atsvc-devel-4.2.4-15.1 libdcerpc-atsvc0-4.2.4-15.1 libdcerpc-atsvc0-debuginfo-4.2.4-15.1 libdcerpc-binding0-4.2.4-15.1 libdcerpc-binding0-debuginfo-4.2.4-15.1 libdcerpc-devel-4.2.4-15.1 libdcerpc-samr-devel-4.2.4-15.1 libdcerpc-samr0-4.2.4-15.1 libdcerpc-samr0-debuginfo-4.2.4-15.1 libdcerpc0-4.2.4-15.1 libdcerpc0-debuginfo-4.2.4-15.1 libgensec-devel-4.2.4-15.1 libgensec0-4.2.4-15.1 libgensec0-debuginfo-4.2.4-15.1 libndr-devel-4.2.4-15.1 libndr-krb5pac-devel-4.2.4-15.1 libndr-krb5pac0-4.2.4-15.1 libndr-krb5pac0-debuginfo-4.2.4-15.1 libndr-nbt-devel-4.2.4-15.1 libndr-nbt0-4.2.4-15.1 libndr-nbt0-debuginfo-4.2.4-15.1 libndr-standard-devel-4.2.4-15.1 libndr-standard0-4.2.4-15.1 libndr-standard0-debuginfo-4.2.4-15.1 libndr0-4.2.4-15.1 libndr0-debuginfo-4.2.4-15.1 libnetapi-devel-4.2.4-15.1 libnetapi0-4.2.4-15.1 libnetapi0-debuginfo-4.2.4-15.1 libregistry-devel-4.2.4-15.1 libregistry0-4.2.4-15.1 libregistry0-debuginfo-4.2.4-15.1 libsamba-credentials-devel-4.2.4-15.1 libsamba-credentials0-4.2.4-15.1 libsamba-credentials0-debuginfo-4.2.4-15.1 libsamba-hostconfig-devel-4.2.4-15.1 libsamba-hostconfig0-4.2.4-15.1 libsamba-hostconfig0-debuginfo-4.2.4-15.1 libsamba-passdb-devel-4.2.4-15.1 libsamba-passdb0-4.2.4-15.1 libsamba-passdb0-debuginfo-4.2.4-15.1 libsamba-policy-devel-4.2.4-15.1 libsamba-policy0-4.2.4-15.1 libsamba-policy0-debuginfo-4.2.4-15.1 libsamba-util-devel-4.2.4-15.1 libsamba-util0-4.2.4-15.1 libsamba-util0-debuginfo-4.2.4-15.1 libsamdb-devel-4.2.4-15.1 libsamdb0-4.2.4-15.1 libsamdb0-debuginfo-4.2.4-15.1 libsmbclient-devel-4.2.4-15.1 libsmbclient-raw-devel-4.2.4-15.1 libsmbclient-raw0-4.2.4-15.1 libsmbclient-raw0-debuginfo-4.2.4-15.1 libsmbclient0-4.2.4-15.1 libsmbclient0-debuginfo-4.2.4-15.1 libsmbconf-devel-4.2.4-15.1 libsmbconf0-4.2.4-15.1 libsmbconf0-debuginfo-4.2.4-15.1 libsmbldap-devel-4.2.4-15.1 libsmbldap0-4.2.4-15.1 libsmbldap0-debuginfo-4.2.4-15.1 libtevent-util-devel-4.2.4-15.1 libtevent-util0-4.2.4-15.1 libtevent-util0-debuginfo-4.2.4-15.1 libwbclient-devel-4.2.4-15.1 libwbclient0-4.2.4-15.1 libwbclient0-debuginfo-4.2.4-15.1 samba-4.2.4-15.1 samba-client-4.2.4-15.1 samba-client-debuginfo-4.2.4-15.1 samba-core-devel-4.2.4-15.1 samba-debuginfo-4.2.4-15.1 samba-debugsource-4.2.4-15.1 samba-libs-4.2.4-15.1 samba-libs-debuginfo-4.2.4-15.1 samba-pidl-4.2.4-15.1 samba-python-4.2.4-15.1 samba-python-debuginfo-4.2.4-15.1 samba-test-4.2.4-15.1 samba-test-debuginfo-4.2.4-15.1 samba-test-devel-4.2.4-15.1 samba-winbind-4.2.4-15.1 samba-winbind-debuginfo-4.2.4-15.1 - openSUSE Leap 42.1 (noarch): samba-doc-4.2.4-15.1 - openSUSE Leap 42.1 (x86_64): libdcerpc-atsvc0-32bit-4.2.4-15.1 libdcerpc-atsvc0-debuginfo-32bit-4.2.4-15.1 libdcerpc-binding0-32bit-4.2.4-15.1 libdcerpc-binding0-debuginfo-32bit-4.2.4-15.1 libdcerpc-samr0-32bit-4.2.4-15.1 libdcerpc-samr0-debuginfo-32bit-4.2.4-15.1 libdcerpc0-32bit-4.2.4-15.1 libdcerpc0-debuginfo-32bit-4.2.4-15.1 libgensec0-32bit-4.2.4-15.1 libgensec0-debuginfo-32bit-4.2.4-15.1 libndr-krb5pac0-32bit-4.2.4-15.1 libndr-krb5pac0-debuginfo-32bit-4.2.4-15.1 libndr-nbt0-32bit-4.2.4-15.1 libndr-nbt0-debuginfo-32bit-4.2.4-15.1 libndr-standard0-32bit-4.2.4-15.1 libndr-standard0-debuginfo-32bit-4.2.4-15.1 libndr0-32bit-4.2.4-15.1 libndr0-debuginfo-32bit-4.2.4-15.1 libnetapi0-32bit-4.2.4-15.1 libnetapi0-debuginfo-32bit-4.2.4-15.1 libregistry0-32bit-4.2.4-15.1 libregistry0-debuginfo-32bit-4.2.4-15.1 libsamba-credentials0-32bit-4.2.4-15.1 libsamba-credentials0-debuginfo-32bit-4.2.4-15.1 libsamba-hostconfig0-32bit-4.2.4-15.1 libsamba-hostconfig0-debuginfo-32bit-4.2.4-15.1 libsamba-passdb0-32bit-4.2.4-15.1 libsamba-passdb0-debuginfo-32bit-4.2.4-15.1 libsamba-policy0-32bit-4.2.4-15.1 libsamba-policy0-debuginfo-32bit-4.2.4-15.1 libsamba-util0-32bit-4.2.4-15.1 libsamba-util0-debuginfo-32bit-4.2.4-15.1 libsamdb0-32bit-4.2.4-15.1 libsamdb0-debuginfo-32bit-4.2.4-15.1 libsmbclient-raw0-32bit-4.2.4-15.1 libsmbclient-raw0-debuginfo-32bit-4.2.4-15.1 libsmbclient0-32bit-4.2.4-15.1 libsmbclient0-debuginfo-32bit-4.2.4-15.1 libsmbconf0-32bit-4.2.4-15.1 libsmbconf0-debuginfo-32bit-4.2.4-15.1 libsmbldap0-32bit-4.2.4-15.1 libsmbldap0-debuginfo-32bit-4.2.4-15.1 libtevent-util0-32bit-4.2.4-15.1 libtevent-util0-debuginfo-32bit-4.2.4-15.1 libwbclient0-32bit-4.2.4-15.1 libwbclient0-debuginfo-32bit-4.2.4-15.1 samba-32bit-4.2.4-15.1 samba-client-32bit-4.2.4-15.1 samba-client-debuginfo-32bit-4.2.4-15.1 samba-debuginfo-32bit-4.2.4-15.1 samba-libs-32bit-4.2.4-15.1 samba-libs-debuginfo-32bit-4.2.4-15.1 samba-winbind-32bit-4.2.4-15.1 samba-winbind-debuginfo-32bit-4.2.4-15.1 References: https://www.suse.com/security/cve/CVE-2015-5370.html https://www.suse.com/security/cve/CVE-2016-2110.html https://www.suse.com/security/cve/CVE-2016-2111.html https://www.suse.com/security/cve/CVE-2016-2112.html https://www.suse.com/security/cve/CVE-2016-2113.html https://www.suse.com/security/cve/CVE-2016-2115.html https://www.suse.com/security/cve/CVE-2016-2118.html https://bugzilla.suse.com/924519 https://bugzilla.suse.com/936862 https://bugzilla.suse.com/968973 https://bugzilla.suse.com/971965 https://bugzilla.suse.com/972197 https://bugzilla.suse.com/973031 https://bugzilla.suse.com/973032 https://bugzilla.suse.com/973033 https://bugzilla.suse.com/973034 https://bugzilla.suse.com/973036 https://bugzilla.suse.com/973832 https://bugzilla.suse.com/974629 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org