Ubuntu 14.04 LTS: USN-2855-2 Moderate Samba Regression Fix

ubuntu

February 16, 2016

USN-2855-1 introduced a regression in Samba.

Summary

USN-2855-1 introduced a regression in Samba.

Software Description:

- samba: SMB/CIFS file, print, and login server for Unix

Details:

USN-2855-1 fixed vulnerabilities in Samba. The upstream fix for

CVE-2015-5252 introduced a regression in certain specific environments.

This update fixes the problem.

Original advisory details:

Thilo Uttendorfer discovered that the Samba LDAP server incorrectly handled

certain packets. A remote attacker could use this issue to cause the LDAP

server to stop responding, resulting in a denial of service. This issue

only affected Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10.

(CVE-2015-3223)

Jan Kasprzak discovered that Samba incorrectly handled certain symlinks. A

remote attacker could use this issue to access files outside the exported

share path. (CVE-2015-5252)

Stefan Metzmacher discovered that Samba did not enforce signing when

creating encrypted connections. If a remote attacker were able to perform a

man-...

Read the Full Advisory

Topics Covered

security advisory denial of service access control samba ubuntu regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  samba                           2:4.1.17+dfsg-4ubuntu3.2

Ubuntu 14.04 LTS:
  samba                           2:4.1.6+dfsg-1ubuntu2.14.04.12

Ubuntu 12.04 LTS:
  samba                           2:3.6.3-2ubuntu2.14

In general, a standard system update will make all the necessary changes.