SUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:1105-1 Rating: important References: #913087 #958582 #973031 #973032 Cross-References: CVE-2015-5252 CVE-2016-2110 CVE-2016-2111 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: Samba was updated to fix three security issues. These security issues were fixed: * CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP authentication (bso#11688, bsc#973031). * CVE-2016-2111: Domain controller netlogon member computer could have been spoofed (bso#11749, bsc#973032). * CVE-2015-5252: Insufficient symlink verification (allowed file access outside the share) (bso#11395, bnc#958582). This non-security issue was fixed: * Allow "delete readonly = yes" to correctly override deletion of a file (bsc#913087, bso#5073) Security Issues: * CVE-2016-2110 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110> * CVE-2016-2111 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111> * CVE-2015-5252 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252> Contraindications: Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): cifs-mount-3.0.36-0.13.32.1 ldapsmb-1.34b-25.13.32.1 libmsrpc-3.0.36-0.13.32.1 libmsrpc-devel-3.0.36-0.13.32.1 libsmbclient-3.0.36-0.13.32.1 libsmbclient-devel-3.0.36-0.13.32.1 samba-3.0.36-0.13.32.1 samba-client-3.0.36-0.13.32.1 samba-krb-printing-3.0.36-0.13.32.1 samba-python-3.0.36-0.13.32.1 samba-vscan-0.3.6b-43.13.32.1 samba-winbind-3.0.36-0.13.32.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): libsmbclient-32bit-3.0.36-0.13.32.1 samba-32bit-3.0.36-0.13.32.1 samba-client-32bit-3.0.36-0.13.32.1 samba-winbind-32bit-3.0.36-0.13.32.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (noarch): samba-doc-3.0.36-0.12.32.1 References: https://www.suse.com/security/cve/CVE-2015-5252.html https://www.suse.com/security/cve/CVE-2016-2110.html https://www.suse.com/security/cve/CVE-2016-2111.html https://bugzilla.suse.com/913087 https://bugzilla.suse.com/958582 https://bugzilla.suse.com/973031 https://bugzilla.suse.com/973032 https://download.suse.com/patch/finder/?keywords=7a8b86525db490aaf0868ada978... -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org