| Summary: | samba new security issues CVE-2018-10858, CVE-2018-1091[89], CVE-2018-1139 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | andrewsfarm, bruno, jim, marja11, sysadmin-bugs, tmb |
| Version: | 6 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA6-64-OK MGA6-32-OK | ||
| Source RPM: | samba-4.7.6-1.mga7.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2018-08-14 23:19:21 CEST
Ubuntu has issued an advisory for this today (August 14): https://usn.ubuntu.com/3738-1/ Whiteboard:
(none) =>
MGA6TOO Assigning to the registered maintainer. CC:
(none) =>
marja11 ldb should also be updated to 1.3.5 in Cauldron. uploaded the following packages: tdb-1.3.16-1.mga7 talloc-2.1.14-1.mga7 ldb-1.4.2-1.mga7 samba-4.9.1-1.mga7 sssd-1.13.4-16.mga7 Assignee:
bgmilne =>
bruno samba-4.6.16-1.mga6 pushed to mga6 updates Assignee:
bruno =>
qa-bugs Advisory: ======================== Updated samba packages fix security vulnerabilities: A malicious server could return a directory entry that could corrupt libsmbclient memory (CVE-2018-10858). Missing access control checks allow discovery of confidential attribute values via authenticated LDAP search expressions (CVE-2018-10919). The samba package has been updated to version 4.6.16, fixing these issues and other bugs. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10858 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10919 https://www.samba.org/samba/security/CVE-2018-10858.html https://www.samba.org/samba/security/CVE-2018-10919.html https://www.samba.org/samba/history/samba-4.6.13.html https://www.samba.org/samba/history/samba-4.6.14.html https://www.samba.org/samba/history/samba-4.6.15.html https://www.samba.org/samba/history/samba-4.6.16.html ======================== Updated packages in core/updates_testing: ======================== samba-4.6.16-1.mga6 samba-client-4.6.16-1.mga6 samba-common-4.6.16-1.mga6 samba-dc-4.6.16-1.mga6 libsamba-dc0-4.6.16-1.mga6 libkdc-samba4_2-4.6.16-1.mga6 libsamba-devel-4.6.16-1.mga6 samba-krb5-printing-4.6.16-1.mga6 libsamba1-4.6.16-1.mga6 libsmbclient0-4.6.16-1.mga6 libsmbclient-devel-4.6.16-1.mga6 libwbclient0-4.6.16-1.mga6 libwbclient-devel-4.6.16-1.mga6 python-samba-4.6.16-1.mga6 samba-pidl-4.6.16-1.mga6 samba-test-4.6.16-1.mga6 libsamba-test0-4.6.16-1.mga6 samba-winbind-4.6.16-1.mga6 samba-winbind-clients-4.6.16-1.mga6 samba-winbind-krb5-locator-4.6.16-1.mga6 samba-winbind-modules-4.6.16-1.mga6 ctdb-4.6.16-1.mga6 ctdb-tests-4.6.16-1.mga6 from samba-4.6.16-1.mga6.src.rpm on mga6-64 plasma packages installed cleanly: - lib64kdc-samba4_2-4.6.16-1.mga6.x86_64 - lib64samba-dc0-4.6.16-1.mga6.x86_64 - lib64samba1-4.6.16-1.mga6.x86_64 - lib64smbclient0-4.6.16-1.mga6.x86_64 - lib64wbclient0-4.6.16-1.mga6.x86_64 - samba-4.6.16-1.mga6.x86_64 - samba-client-4.6.16-1.mga6.x86_64 - samba-common-4.6.16-1.mga6.x86_64 After installing this update: I can read and write to a share on this system from another system I can read and write to a share on another system from this system OK for mga6-64 Whiteboard:
(none) =>
MGA6-64-OK on mga6-32 in a vbox VM packages installed cleanly: - libkdc-samba4_2-4.6.16-1.mga6.i586 - libsamba-dc0-4.6.16-1.mga6.i586 - libsamba1-4.6.16-1.mga6.i586 - libsmbclient0-4.6.16-1.mga6.i586 - libwbclient0-4.6.16-1.mga6.i586 - samba-4.6.16-1.mga6.i586 - samba-client-4.6.16-1.mga6.i586 - samba-common-4.6.16-1.mga6.i586 After installing this update: I can read and write to a share on this system from another system I can read and write to a share on another system from this system OK for mga6-32 Whiteboard:
MGA6-64-OK =>
MGA6-64-OK MGA6-32-OK Validating. Advisory in Comment 6. Keywords:
(none) =>
validated_update
Thomas Backlund
2018-10-30 17:43:44 CET
CC:
(none) =>
tmb An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0424.html Resolution:
(none) =>
FIXED |