Samba has issued advisories today (August 14): https://www.samba.org/samba/security/CVE-2018-10858.html https://www.samba.org/samba/security/CVE-2018-10918.html https://www.samba.org/samba/security/CVE-2018-10919.html https://www.samba.org/samba/security/CVE-2018-1139.html The issues are fixed upstream in 4.7.9 and 4.6.16: https://www.samba.org/samba/history/samba-4.7.9.html https://www.samba.org/samba/history/samba-4.6.16.html CVE-2018-10858 also affects Mageia 5 and Mageia 6. CVE-2018-10919 also affects Mageia 6. Debian has issued an advisory for those two issues today (August 14): https://www.debian.org/security/2018/dsa-4271
Ubuntu has issued an advisory for this today (August 14): https://usn.ubuntu.com/3738-1/
Whiteboard: (none) => MGA6TOO
Assigning to the registered maintainer.
CC: (none) => marja11Assignee: bugsquad => bgmilne
ldb should also be updated to 1.3.5 in Cauldron.
uploaded the following packages: tdb-1.3.16-1.mga7 talloc-2.1.14-1.mga7 ldb-1.4.2-1.mga7 samba-4.9.1-1.mga7 sssd-1.13.4-16.mga7
Assignee: bgmilne => brunoCC: (none) => brunoStatus: NEW => ASSIGNEDVersion: Cauldron => 6Whiteboard: MGA6TOO => (none)
samba-4.6.16-1.mga6 pushed to mga6 updates
Assignee: bruno => qa-bugs
Advisory: ======================== Updated samba packages fix security vulnerabilities: A malicious server could return a directory entry that could corrupt libsmbclient memory (CVE-2018-10858). Missing access control checks allow discovery of confidential attribute values via authenticated LDAP search expressions (CVE-2018-10919). The samba package has been updated to version 4.6.16, fixing these issues and other bugs. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10858 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10919 https://www.samba.org/samba/security/CVE-2018-10858.html https://www.samba.org/samba/security/CVE-2018-10919.html https://www.samba.org/samba/history/samba-4.6.13.html https://www.samba.org/samba/history/samba-4.6.14.html https://www.samba.org/samba/history/samba-4.6.15.html https://www.samba.org/samba/history/samba-4.6.16.html ======================== Updated packages in core/updates_testing: ======================== samba-4.6.16-1.mga6 samba-client-4.6.16-1.mga6 samba-common-4.6.16-1.mga6 samba-dc-4.6.16-1.mga6 libsamba-dc0-4.6.16-1.mga6 libkdc-samba4_2-4.6.16-1.mga6 libsamba-devel-4.6.16-1.mga6 samba-krb5-printing-4.6.16-1.mga6 libsamba1-4.6.16-1.mga6 libsmbclient0-4.6.16-1.mga6 libsmbclient-devel-4.6.16-1.mga6 libwbclient0-4.6.16-1.mga6 libwbclient-devel-4.6.16-1.mga6 python-samba-4.6.16-1.mga6 samba-pidl-4.6.16-1.mga6 samba-test-4.6.16-1.mga6 libsamba-test0-4.6.16-1.mga6 samba-winbind-4.6.16-1.mga6 samba-winbind-clients-4.6.16-1.mga6 samba-winbind-krb5-locator-4.6.16-1.mga6 samba-winbind-modules-4.6.16-1.mga6 ctdb-4.6.16-1.mga6 ctdb-tests-4.6.16-1.mga6 from samba-4.6.16-1.mga6.src.rpm
on mga6-64 plasma packages installed cleanly: - lib64kdc-samba4_2-4.6.16-1.mga6.x86_64 - lib64samba-dc0-4.6.16-1.mga6.x86_64 - lib64samba1-4.6.16-1.mga6.x86_64 - lib64smbclient0-4.6.16-1.mga6.x86_64 - lib64wbclient0-4.6.16-1.mga6.x86_64 - samba-4.6.16-1.mga6.x86_64 - samba-client-4.6.16-1.mga6.x86_64 - samba-common-4.6.16-1.mga6.x86_64 After installing this update: I can read and write to a share on this system from another system I can read and write to a share on another system from this system OK for mga6-64
Whiteboard: (none) => MGA6-64-OKCC: (none) => jim
on mga6-32 in a vbox VM packages installed cleanly: - libkdc-samba4_2-4.6.16-1.mga6.i586 - libsamba-dc0-4.6.16-1.mga6.i586 - libsamba1-4.6.16-1.mga6.i586 - libsmbclient0-4.6.16-1.mga6.i586 - libwbclient0-4.6.16-1.mga6.i586 - samba-4.6.16-1.mga6.i586 - samba-client-4.6.16-1.mga6.i586 - samba-common-4.6.16-1.mga6.i586 After installing this update: I can read and write to a share on this system from another system I can read and write to a share on another system from this system OK for mga6-32
Whiteboard: MGA6-64-OK => MGA6-64-OK MGA6-32-OK
Validating. Advisory in Comment 6.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
CC: (none) => tmbKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0424.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED