Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

SUSE 10: 2013:0519-1 Important: Samba CSRF & Clickjacking Risks

suse
Calendar Grey March 22, 2013
Scroller Suse
Recent developments reveal critical Samba vulnerabilities in SUSE Linux, including remote code execution and data leakage documented in several CVEs.
An update that solves two vulnerabilities and has 6 fixes An update that solves two vulnerabilities and has 6 fixes An update that solves two vulnerabilities and has 6 fixes is now...

Summary

The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 was affected by a cross-site request forgery; CVE-2013-0214; (bnc#799641). The Samba Web Administration Tool (SWAT) in Samba versions 3.0.x to 4.0.1 could possibly be used in clickjacking attacks; CVE-2013-0213; (bnc#800982). Also the following bugs have been fixed: * Don't clutter the spec file diff view; (bnc#783384). * s3: Fix uninitialized memory read in talloc_free(); (bnc#764577). * Attempt to use samlogon validation level 6; (bso#7945); (bnc#741623). * Add PreReq /etc/init.d/nscd to the winbind package; (bnc#759731). * Recover from ncacn_ip_tcp ACCESS_DENIED/SEC_PKG_ERROR lsa errors; (bso#7944); (bnc#755663). * Fix lsa_LookupSids3 and lsa_LookupNames4 arguments. Security Issue references: * CVE-2013-0213

Topics%20covered

Topics Covered

security advisory important SUSE Samba CSRF clickjacking risks

References

#499233 #741623 #755663 #759731 #764577 #783384

#799641 #800982

Cross- CVE-2013-0213 CVE-2013-0214

Affected Products:

SUSE Linux Enterprise Server 10 GPLv3 Extras

https://www.suse.com/security/cve/CVE-2013-0213.html

https://www.suse.com/security/cve/CVE-2013-0214.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2013:0519-1
Rating: important

Topics%20covered

Topics Covered

security advisory important SUSE Samba CSRF clickjacking risks

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.