Bug 11871 - samba new security issues CVE-2012-6150 and CVE-2013-4408
: samba new security issues CVE-2012-6150 and CVE-2013-4408
Status: RESOLVED FIXED
Product: Mageia
Classification: Unclassified
Component: Security
: 3
: i586 Linux
: Normal Severity: critical
: ---
Assigned To: QA Team
: Sec team
: http://lwn.net/Vulnerabilities/576257/
: advisory mga3-32-ok mga3-64-ok
: validated_update
:
:
  Show dependency treegraph
 
Reported: 2013-12-04 16:29 CET by David Walser
Modified: 2013-12-12 23:26 CET (History)
2 users (show)

See Also:
Source RPM: samba-3.6.15-1.2.mga3.src.rpm
CVE:


Attachments

Description David Walser 2013-12-04 16:29:17 CET
A CVE was allocated for a security issue fixed upstream on December 2:
http://openwall.com/lists/oss-security/2013/12/03/5

The patch was obtained from the upstream bug:
https://bugzilla.samba.org/show_bug.cgi?id=10300
https://attachments.samba.org/attachment.cgi?id=9499

Fixed in samba-3.6.21-2.mga4 for Cauldron.  Patch added in Mageia 3 SVN.

RedHat has rated it as low severity and hasn't taken any action on it yet:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6150

Upstream also hasn't issued new versions with the fix yet (though the fix is committed in the various branches), so maybe we don't need to push this yet.

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2013-12-10 00:35:42 CET
Debian has issued an advisory today (December 9):
http://www.debian.org/security/2013/dsa-2812

This fixes an additional issue, CVE-2013-4408.

RedHat has rated it as a high severity issue:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4408

Patched packages uploaded for Mageia 3 and Cauldron.

Advisory:
========================

Updated samba packages fix security vulnerabilities:

Samba before 3.6.22 incorrectly allows login from authenticated users if the
require_membership_of parameter of pam_winbind specifies only invalid group
names (CVE-2012-6150).

It was discovered that multiple buffer overflows in the processing of DCE-RPC
packets may lead to the execution of arbitrary code (CVE-2013-4408).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6150
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4408
http://www.samba.org/samba/security/CVE-2012-6150
http://www.samba.org/samba/security/CVE-2013-4408
http://www.debian.org/security/2013/dsa-2812
========================

Updated packages in core/updates_testing:
========================
samba-server-3.6.15-1.3.mga3
samba-client-3.6.15-1.3.mga3
samba-common-3.6.15-1.3.mga3
samba-doc-3.6.15-1.3.mga3
samba-swat-3.6.15-1.3.mga3
samba-winbind-3.6.15-1.3.mga3
nss_wins-3.6.15-1.3.mga3
libsmbclient0-3.6.15-1.3.mga3
libsmbclient0-devel-3.6.15-1.3.mga3
libsmbclient0-static-devel-3.6.15-1.3.mga3
libnetapi0-3.6.15-1.3.mga3
libnetapi-devel-3.6.15-1.3.mga3
libsmbsharemodes0-3.6.15-1.3.mga3
libsmbsharemodes-devel-3.6.15-1.3.mga3
libwbclient0-3.6.15-1.3.mga3
libwbclient-devel-3.6.15-1.3.mga3
samba-virusfilter-clamav-3.6.15-1.3.mga3
samba-virusfilter-fsecure-3.6.15-1.3.mga3
samba-virusfilter-sophos-3.6.15-1.3.mga3
samba-domainjoin-gui-3.6.15-1.3.mga3

from samba-3.6.15-1.3.mga3.src.rpm
Comment 2 David Walser 2013-12-11 21:00:54 CET
Ubuntu has issued an advisory for this today (December 11):
http://www.ubuntu.com/usn/usn-2054-1/

LWN reference for CVE-2012-6150:
http://lwn.net/Vulnerabilities/576621/
Comment 3 claire robinson 2013-12-12 16:53:00 CET
Testing complete mga3 32 & 64

Mounted a share in each direction.

Advisory uploaded. Validating.

Could sysadmin please push from 3 core/updates_testing to updates

Thanks!
Comment 4 Thomas Backlund 2013-12-12 23:26:15 CET
Update pushed:
http://advisories.mageia.org/MGASA-2013-0369.html

Note You need to log in before you can comment on or make changes to this bug.