Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.0790.2
samba security update
3 April 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: samba
Publisher: Debian
Operating System: Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-2619
Original Bulletin:
http://www.debian.org/security/2017/dsa-3816
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running samba check for an updated version of the software for their
operating system.
Revision History: April 3 2017: Two regressions were introduced by the samba
update in DSA-3816-1
March 24 2017: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3816-2 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
April 02, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : samba
Debian Bug : 858564 858590 858648 859101
Two regressions were introduced by the samba update in DSA-3816-1.
Updated packages are now available to address these problems.
Additionally a regression from DSA-3548-1 causing `net ads join` to
freeze when run a second time is fixed along with this update. For
reference, the original advisory text follows.
Jann Horn of Google discovered a time-of-check, time-of-use race
condition in Samba, a SMB/CIFS file, print, and login server for Unix. A
malicious client can take advantage of this flaw by exploiting a symlink
race to access areas of the server file system not exported under a
share definition.
For the stable distribution (jessie), these problems have been fixed in
version 2:4.2.14+dfsg-0+deb8u5.
We recommend that you upgrade your samba packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAljhD25fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Szhw/+JbQhfuuRjQyDlxmFl8NdD72PfrTvwUDo3cpVZZ8wOMQSZX0/PHzWa3LL
Bn58LuNEleUtnzqNWa2QQ9G8quuYUyJZTFjj9VWQgW1VCDKJznI4giwFbu8/Ky3I
0oo9NC0EgzZblCEW9fM05GJK7LO14CDWq5GnwNszHqA7Azvhd2dnv1qJ2sF+gCEt
CBjn9M2mIzMwUfzUj6PopQm2XaFTlQzxsiQXKPoNYf4M3ezShb02DohsG43IL+TL
Zeee+iHPA1xnNXTy43ChhlvLNZaPycPjx7rBdJUeU6jSBGc42V9TQ/xuhM6gcQL5
FYO/ZE/8sxXJSCaXRmrAkGTj4wycMeYlvhnqzTCxKoNX3fEDdGMlylhOXrXBjKDX
Y/nRqeCx9FFMaNQqQIIacP4Ul4YwoHmY948ApL6qVwWt2XxpOEaA56Z88++UtMG0
vmA/4PjuNaUwxyDkhukYaEjf15Pekh9p52K2m/Zn24za1F7W5FEDyP2n6h8owtMP
xnz61etY5vn8WJxr3ItdZ+nbWoWUrqRw5KoQO/Y6xQ+h50JQb7T5XE178sviiJqe
yCCtzOr0bQ3Uafs3h9To949IFi4SDQZhsSvHWKBstXV0ufo/qGN9muBhOf3oNX5h
9DUdKiAeS8b9U0WcYUObf46gVkWAsQynsEsr9GjDOGHkuirvaWM=
=EnO9
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3816-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 23, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : samba
CVE ID : CVE-2017-2619
Jann Horn of Google discovered a time-of-check, time-of-use race
condition in Samba, a SMB/CIFS file, print, and login server for Unix. A
malicious client can take advantage of this flaw by exploting a symlink
race to access areas of the server file system not exported under a
share definition.
For the stable distribution (jessie), this problem has been fixed in
version 2:4.2.14+dfsg-0+deb8u4.
For the unstable distribution (sid), this problem has been fixed in
version 2:4.5.6+dfsg-2.
We recommend that you upgrade your samba packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAljTrzNfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0RthhAAnOMWMQYULwrwAWxUEOkrb1/4pzE/vuCBIb3dVR08HheUfdp7WIComgl5
aO39kndwqBIUeuMGu7HtUtYpnA1NfDpjA0NmcZerioFy4DJLXV3FEqOI+7J3uuSu
pPfUGU68OGy2GyZHtxYX+lq7al+fKAHkS1psOpVCwC7LCX6O3todbXAyDr+/VSjf
Vfy5xFeX+VX/sNN3Mkv6m/p4qY//4tESBQYZBE9EJ800bwJHNIcE0QnEi6BtYjRi
iYgfQQVGnk0biWp0TfITyHef7ptKBTHWFAYzqjYCArWSGjXaVkRj8fuXQPB/yz16
Gr75bLIJBkqsY+X7mO5OE6Sp0kWcNqo+IOoxmVjwx7nfeviiHqIer/feFlDLXlij
JBa62iCmacjkfzHaR62zImzKph6rOmw32R6vqJeXOgvZRacdsScpdf6n8hgcdQHo
mEw0zlJ5TmDUwBo+9P0UjDoaGldoc15jo0aBMO07YFQ0zNSX53i40alkPnwroovL
27T+VjS6LLCbdYQwnq/gzHo7TweZyb7E/AnbGuEx3vvWA+RDIKKCec4vA6mzg8zd
KTutOmyL444hTMaXpVOTI3qytW725PjE8Nqe8WGSTJb1KwvUz3MmPaH4Luidg5vO
bmDBuBXVx8cwriVrgaJKRQbZRrRejHW0fbI/C5+oX+hj9PjdQEQ=
=Iab8
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWOGPkox+lLeg9Ub1AQg3RA//TGbPnKYsZEzUnTtw9ZaIzVT5xGxE5LrA
/hOr7ibADsapZQEDfiR9j4nWXaK02QE9TJh2rmifcJaboQreNB77Kd8uXTGMwn45
jcuszoaI9qD5UqbpU2ekxgh8AC8kZnCcvgSWbcMPYFAKG4dfVDTlvbHUhGcC7Pqc
m9AOmG4sbPP179Nt/JljyA1jYHKoJWIBDSQafXqo78ffVPuyhtOugXqUYsVfuqCu
DvMnEAoeYMAANJzP1Q7ly6KCsPKNwWv0D8J6CGvFxAlPqVOEd3WcrPcoLx1J1EkI
644AH2uEI/20N9/Z18DEZrWLpg74BcA2dgQ9xjyk1KuHVE032nCHHZA3B34XFDHD
4VdK+DY26pJvGmA33nc8meQ9WF8sUyB0k3lP3grkQcV17JJvpo6bv5BMFS18wSGn
5iiDy0axylv7nCksn3xPcSYlS6WEoVRf9uM+lWFji9VjrpIHV6CQsuxjVR5vuFbf
qLfJhC/VSLCr/p1yyQG0NQFZFLbz1iNAkxZPmHAM9byo/nKGy4NWaSOMEdoKSB0u
XdfOBfg61raUQ7xM0E6hlRtK4RRmQApG+eHbTpKHXCaWaRvkAyN1RtaPu3rqiWem
IsCS7u0EmVama8NEEjHjqMybb2HkStH9VJZ9DRhdbv9yQe/dlbOW+TNdg2xvWcGB
LpDetnUJveY=
=0r6Y
-----END PGP SIGNATURE-----