Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1632
libntlm security update
11 May 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libntlm
Publisher: Debian
Operating System: Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-17455
Original Bulletin:
https://www.debian.org/lts/security/2020/dla-2207
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running libntlm check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Package : libntlm
Version : 1.4-3+deb8u1
CVE ID : CVE-2019-17455
It was discovered that libntlm through 1.5 relies on a fixed buffer
size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and
tSmbNtlmAuthResponse
read and write operations, as demonstrated by a stack-based buffer
over-read in buildSmbNtlmAuthRequest in smbutil.c for a crafted NTLM
request.
For Debian 8 "Jessie", this problem has been fixed in version
1.4-3+deb8u1.
We recommend that you upgrade your libntlm packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAl64K/kACgkQ0+Fzg8+n
/wbYhw/+IYUw88cFkAa1sK8EdXbLQvbmE/2dOD3ZaaJsrxtB2L3aTORyjcpe3FEI
wgQ+mM7Tn4o3IAVVcKq3xjYyBG/k+wKRTfGnWQJI9aJivDZYpYbR06fFya95HC7+
FpBFwAwEA1AVHOif3jAjDSMKKrxRhML58zj7cIZLYybgfcooTk3jrn+e1Y+0XxnX
Y+uslnvvAunRh6n67+Gbq8Nf3oqXV22039XpvUQbzApSkgWJojRvx1IlNUFT5JOL
a8jdbtTc0l6DegIWmpvkrB1wFHq93g9zZBvbRUBP8VyMnsZCR6LV7GZMI04N/Cl0
CeJmVenE9i5bTBaVcNMvuXGWtjzm7mTgFiILck1qk7zxSZnJJnZeHE3qb/+iaCZn
SxQpu+EXudw2V1SaqvPr8FUPA6DWRV8nnmlneYLq/5DJJJEBUMU4GTiTIrdUpyjE
rzOvQ3rivd/ILvAsKmVQU5Tu8fpqMNR4tKpv/mu8ybU2oF7z8jmtv4p/B3ywYOXr
owGt8CEJ4b6FwGJiMWiccd0fkGx1rtSXqUSA802ctIEnjyG88Cvhtvb7J9c5GrvU
I3H3PaMYBiANnxPOZ1XSCNpMh1flqBLX60O70rX4/RkfhoNTMiXmWLB2t8lxMofw
NJGcSfKTdlePFANF9DUK9y8ifby39XaoxqbIp8dequY28mMpPwc==40TN
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXrikp2aOgq3Tt24GAQh9ZQ/9EBEB17WvTZpLFz9PJU3l0X9g+qlu6VGV
WVY5HSRLNK/oiRazFm8rgq3nkGK0x3raYXAKlFNERs79AIaIpDWLBxni5Azd+s/d
p2xjx54ceeC1IKIHOmvPbm5yXGq0uKsWKF6LQR5937WcFvKz88RtwEpmP22Spu0c
X49M18K7TCrLS0/3Mg+NdApcQjYQT6EaCTz5/vTfYB0KzwaquAi+OPDvyj7WwWf9
YcE2ih42pfi6B6COilaes8iH9u2i7R10SYmewxwBHUmQlZJ1pOZye1XPCtPyXODE
gy1lKZmS66OkmvdUrEnFx7psHNFb6zUf1uVNYJD+wGu3JVjkzx2UaGSFL7PI0REj
ljTe21cl4BMYRRsrrXG4TeO1n6LC7dQlz8akYG9gf07I97+FCIgOGtoQ54XxIaK6
3jfo3pR8WRkc5zMOj/+L3oiRZQvBuHlGX+LCP2fP5tSJQpwqwKbUJNopxZ61eBzQ
QFUPmvTsCv0pHHmuQW5+JqYhpNfnANe2kmhJoQ50cINgU2dtwOxStccQBjuej5+x
a8cJpOppO91F5lrFkp/gWOuJXq1/6epqmmGYp766l8hTcbk97IaCFH5wRtNtIlIl
q+Kypo4fZvhoU3pR4/WKeQGMJ4ZtUJX0c0vM44K7z3GI6fGCo+MAg3QNdfWpDxVM
JUzdHioj7OU=
=gk1a
-----END PGP SIGNATURE-----