| Summary: | samba new security issues CVE-2017-2619 and CVE-2017-7494 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | bgmilne, davidwhodgins, marja11, pkg-bugs, sysadmin-bugs, zombie_ryushu |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | advisory MGA5-64-OK MGA5-32-OK | ||
| Source RPM: | samba-3.6.25-2.6.mga5.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2017-03-23 14:30:35 CET
Ubuntu has issued an advisory for this today (March 23): https://www.ubuntu.com/usn/usn-3242-1/ They have a patch for 3.6.25. RedHat has also said that they fixed CVE-2016-2126 for 3.6.x, when upstream's advisory says it only affects 4.0.0 and newer: https://rhn.redhat.com/errata/RHSA-2017-0662.html Should look to see if RedHat has a patch we're missing in RHEL6. Assigning to the registered maintainer, but CC'ing all packagers collectively, in case the maintainer is unavailable. CC:
(none) =>
marja11, pkg-bugs Note that samba has made new upstream releases to fix a regression from the initial CVE-2017-2619 fix, so we'll probably need another patch from Ubuntu. Indeed, Ubuntu has issued a regression advisory on March 30: https://www.ubuntu.com/usn/usn-3242-2/ A new Samba Regression fix exists. in 4.x https://www.samba.org/samba/history/samba-4.6.3.html CC:
(none) =>
zombie_ryushu Upstream has issued an advisory today (May 24): https://www.samba.org/samba/security/CVE-2017-7494.html RHEL6 has the patch(es) for this: https://rhn.redhat.com/errata/RHSA-2017-1270.html Summary:
samba new security issue CVE-2017-2619 =>
samba new security issues CVE-2017-2619 and CVE-2017-7494 I have added the following in svn: Commit 1104446: CVE-2016-2126 Commit 1104449: CVE-2017-2619 as well as the fix for samba#12721 (regression in the initial patch) Commit 1104450: CVE-2017-7494 Currently building as committed locally .... Status:
NEW =>
ASSIGNED Package built successfully, minimal testing done (it upgrades). samba-3.6.25-2.7.mga5 submitted and partially built. I won't have time to look at advisory text today. Assignee:
bgmilne =>
qa-bugs Thanks Buchan! Advisory: ======================== Updated samba packages fix security vulnerabilities: A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process (CVE-2016-2126). Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacker could use this issue to access files on the server outside of the exported directories (CVE-2017-2619). A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root (CVE-2017-7494). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2126 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2619 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7494 https://www.samba.org/samba/security/CVE-2016-2126.html https://www.samba.org/samba/security/CVE-2017-2619.html https://www.samba.org/samba/security/CVE-2017-7494.html https://rhn.redhat.com/errata/RHSA-2017-0662.html https://www.ubuntu.com/usn/usn-3242-1/ https://www.ubuntu.com/usn/usn-3242-2/ https://rhn.redhat.com/errata/RHSA-2017-1270.html ======================== Updated packages in core/updates_testing: ======================== samba-server-3.6.25-2.7.mga5 samba-client-3.6.25-2.7.mga5 samba-common-3.6.25-2.7.mga5 samba-doc-3.6.25-2.7.mga5 samba-swat-3.6.25-2.7.mga5 samba-winbind-3.6.25-2.7.mga5 nss_wins-3.6.25-2.7.mga5 libsmbclient0-3.6.25-2.7.mga5 libsmbclient0-devel-3.6.25-2.7.mga5 libsmbclient0-static-devel-3.6.25-2.7.mga5 libnetapi0-3.6.25-2.7.mga5 libnetapi-devel-3.6.25-2.7.mga5 libsmbsharemodes0-3.6.25-2.7.mga5 libsmbsharemodes-devel-3.6.25-2.7.mga5 libwbclient0-3.6.25-2.7.mga5 libwbclient-devel-3.6.25-2.7.mga5 samba-virusfilter-clamav-3.6.25-2.7.mga5 samba-virusfilter-fsecure-3.6.25-2.7.mga5 samba-virusfilter-sophos-3.6.25-2.7.mga5 samba-domainjoin-gui-3.6.25-2.7.mga5 from samba-3.6.25-2.7.mga5.src.rpm Before and after installing the update ...
$ smbtree
Enter dave's password:
MGAGROUP
\\X5V x5v
\\X5V\dave Home Directories
\\X5V\IPC$ IPC Service (x5v)
\\X5V\homes Home Directories
\\X5V\pdf-gen PDF Generator (only valid users)
\\X5V\print$
\\I5V i5v
\\I5V\dave Home Directories
\\I5V\IPC$ IPC Service (i5v)
\\I5V\homes Home Directories
\\I5V\pdf-gen PDF Generator (only valid users)
Working to access Mageia 5 i586 vb guest samba share from x86_64 vb guest and vice versa.
Validating the update.Whiteboard:
(none) =>
MGA5-64-OK MGA5-32-OK advisory Missed an error message. Update failed to install. Unvalidating.
Installation failed: file /usr/lib64/samba/vfs/svf-clamav.so from install of samba-server-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-virusfilter-clamav-3.6.25-2.6.mga5.x86_64
file /usr/lib64/samba/vfs/svf-sophos.so from install of samba-server-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-virusfilter-sophos-3.6.25-2.6.mga5.x86_64
file /usr/lib64/samba/vfs/svf-fsav.so from install of samba-server-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-virusfilter-fsecure-3.6.25-2.6.mga5.x86_64
file /usr/lib64/samba/vfs/svf-fsav.so from install of samba-virusfilter-fsecure-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-server-3.6.25-2.6.mga5.x86_64
file /usr/lib64/samba/vfs/svf-sophos.so from install of samba-virusfilter-sophos-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-server-3.6.25-2.6.mga5.x86_64
file /usr/lib64/samba/vfs/svf-clamav.so from install of samba-virusfilter-clamav-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-server-3.6.25-2.6.mga5.x86_64Whiteboard:
MGA5-64-OK MGA5-32-OK advisory =>
advisory After discussing with David Walser on irc, decided to let this update through, as most people will not have the virus filters installed. I'll open a new bug for the conflicts. Testing complete after using urpmi --allow-force to install the update. Re-validating the update Whiteboard:
advisory =>
advisory MGA5-64-OK MGA5-32-OK bug 20928 opened for the file conflicts during updates. As noted in #20928, there is a fix in svn commit 1104503 that would fix the conflicts after bumping subrel. An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0145.html Resolution:
(none) =>
FIXED |