Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
172
security advisoryremote accessubuntuUbuntu 24.04 LTS Security Notice USN-7051-1: Medium Risk AsyncSSH Issue
A protocol flaw was fixed in AsyncSSH.. ========================================================================== Ubuntu Security Notice USN-7051-1 October 02, 2024 python-asyncssh vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: A protocol flaw was fixed in AsyncSSH. Software Description: - python-asyncssh: asyncio-based client and server implementation of SSHv2 protocol Details: Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS python3-asyncssh 2.10.1-2ubuntu0.1 Ubuntu 22.04 LTS python3-asyncssh 2.5.0-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS python3-asyncssh 1.12.2-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7051-1 CVE-2023-48795 Package Information: . An issue related to a protocol vulnerability in python-asyncssh has been rectified in Ubuntu versions 24.04, 22.04, and 20.04 LTS. Discover details regarding the recent security modification.. protocol flaw, asyncssh, ubuntu, security update, SSH communications. . Severity: Medium. LinuxSecurity.com Team
Oct 02, 2024
•Medium
Ubuntu
203
security advisoryauthentication issuefreeradiusMageia 9: MGASA-2024-0264 Critical: Freeradius Authentication Bypass
This vulnerability allows an attacker performing a meddler-in-the-middle attack between Palo Alto Networks PAN-OS firewall and a RADIUS server to bypass authentication and escalate privileges to âsuperuserâ when RADIUS authentication is in use and either CHAP or PAP is selected in the RADIUS server profile. . MGASA-2024-0264 - Updated freeradius packages fix security vulnerability Publication date: 14 Jul 2024 URL: https://advisories.mageia.org/MGASA-2024-0264.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-3596 This vulnerability allows an attacker performing a meddler-in-the-middle attack between Palo Alto Networks PAN-OS firewall and a RADIUS server to bypass authentication and escalate privileges to âsuperuserâ when RADIUS authentication is in use and either CHAP or PAP is selected in the RADIUS server profile. CHAP and PAP are protocols with no Transport Layer Security (TLS), and hence vulnerable to meddler-in-the-middle attacks. Neither protocol should be used unless they are encapsulated by an encrypted tunnel. If they are in use, but are encapsulated within a TLS tunnel, they are not vulnerable to this attack. For additional information regarding this vulnerability, please see https://www.blastradius.fail/. Note: these two lines are added upstream in the default radiusd.conf file: """ require_message_authenticator = auto limit_proxy_state = auto """ References: - https://bugs.mageia.org/show_bug.cgi?id=33388 - https://www-fr.freeradius.org/security/ - https://www.openwall.com/lists/oss-security/2024/07/09/4 - https://www.cve.org/CVERecord?id=CVE-2024-3596 SRPMS: - 9/core/freeradius-3.0.27-1.mga9 . Updates to the Freeradius package for Mageia address a significant authentication vulnerability impacting PAN-OS.. Mageia Freeradius Security Updates, Authentication Bypass Exploit, Middle Attack Prevention. . Severity: Critical. LinuxSecurity.com Team
Jul 14, 2024
•Critical
Mageia
172
security advisorypackage updateUbuntuUbuntu 23.10 USN-6599-1 low: openssl critical patch update
A protocol flaw was fixed in Paramiko.. ========================================================================== Ubuntu Security Notice USN-6598-1 January 25, 2024 paramiko vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: A protocol flaw was fixed in Paramiko. Software Description: - paramiko: Python SSH2 library Details: Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: python3-paramiko 2.12.0-2ubuntu1.23.10.2 Ubuntu 22.04 LTS: python3-paramiko 2.9.3-0ubuntu1.2 Ubuntu 20.04 LTS: python3-paramiko 2.6.0-2ubuntu0.3 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6598-1 CVE-2023-48795 Package Information: https://launchpad.net/ubuntu/+source/paramiko/2.12.0-2ubuntu1.23.10.2 https://launchpad.net/ubuntu/+source/paramiko/2.9.3-0ubuntu1.2 https://launchpad.net/ubuntu/+source/paramiko/2.6.0-2ubuntu0.3 . OpenSSH vulnerabilities resolved in several Debian releases to tackle SSH protocol weaknesses and prevent potential exploit scenarios.. Paramiko flaw, SSH update, Ubuntu security. . Severity: Low. LinuxSecurity.com Team
Jan 25, 2024
•Low
Ubuntu
203
security advisorysambaadministrator accessMageia 7: MGASA-2020-0380 Moderate: Samba Netlogon Protocol Flaw
When Samba is used as a domain controller, an unauthenticated attacker on the network can gain administrator access by exploiting a netlogon protocol flaw (CVE-2020-1472). Note that Samba installations are not vulnerable unless they have the smb.conf . MGASA-2020-0380 - Updated samba packages fix security vulnerability Publication date: 30 Sep 2020 URL: https://advisories.mageia.org/MGASA-2020-0380.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-1472 When Samba is used as a domain controller, an unauthenticated attacker on the network can gain administrator access by exploiting a netlogon protocol flaw (CVE-2020-1472). Note that Samba installations are not vulnerable unless they have the smb.conf lines 'server schannel = no' or 'server schannel = auto'. References: - https://bugs.mageia.org/show_bug.cgi?id=27299 - - - https://ubuntu.com/security/notices/USN-4510-1 - https://www.cve.org/CVERecord?id=CVE-2020-1472 SRPMS: - 7/core/samba-4.10.18-1.mga7 . The Samba security update MGASA-2020-0380 resolves an issue with administrative access stemming from a vulnerability in the netlogon protocol.. samba security, mageia advisory, network vulnerabilities, admin access protocols, netlogon exploitation. . LinuxSecurity.com Team
Sep 30, 2020
Mageia
200
security advisorycriticalbug fixScientific Linux: SLSA-2016:0612-1 Critical: Samba and Samba4 DoS Issues
Critical: samba and samba4 security, bug fix, and . Date: Tue, 12 Apr 2016 17:49:02 -0500 Reply-To: "scientific-linux-users@" Sender: Security Errata for Scientific Linux From: Pat Riehecky Subject: Badlock Bug updates are now live for SL MIME-Version: 1.0 Message-ID: Some errata emails seem to have gotten stuck in the publication process. The following updates are published for SL: SA-2016:0611-1 SA-2016:0612-1 SA-2016:0613-1 SA-2016:0621-1 Interested users can run yum clean expire-cache now -- Pat Riehecky Scientific Linux developer Fermi National Accelerator Laboratory www.fnal.gov https://scientificlinux.org/ Date: Wed, 13 Apr 2016 02:48:50 -0000 Reply-To: scientific-linux-users@ Sender: Security Errata for Scientific Linux From: Pat Riehecky Subject: Security ERRATA Critical: samba and samba4 on SL6.x, SL7.x i386/x86_64 MIME-Version: 1.0 Message-ID: Synopsis: Critical: samba and samba4 security, bug fix, and Advisory ID: SLSA-2016:0612-1 Issue Date: 2016-04-12 CVE Numbers: CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2115 CVE-2016-2118 CVE-2015-5370 CVE-2016-2113 CVE-2016-2114 -- Security Fix(es): * Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC). (CVE-2015-5370) Note: While Samba packages as shipped in Scientific Linux do not support running Samba as an AD DC, this flaw applies to all roles Samba implements. * A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol(MS-LSAD). Any authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server. As a result, the attacker would be able to get read/write access to the Security Account Manager database, and use this to reveal all passwords or any other potentially sensitive information in that database. (CVE-2016-2118) * Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection. (CVE-2016-2110) * It was discovered that Samba configured as a Domain Controller would establish a secure communication channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111) * It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections. (CVE-2016-2112) * It was found that Samba did not validate SSL/TLS certificates in certain connections. A man-in-the-middle attacker could use this flaw to spoof a Samba server using a specially crafted SSL/TLS certificate. (CVE-2016-2113) * It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a server. (CVE-2016-2114) * It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use thisflaw to view and modify the data sent between a Samba server and a client. (CVE-2016-2115) -- SL6 x86_64 ipa-client-3.0.0-47.el6_7.2.x86_64.rpm ipa-debuginfo-3.0.0-47.el6_7.2.x86_64.rpm ipa-python-3.0.0-47.el6_7.2.x86_64.rpm libldb-1.1.25-2.el6_7.i686.rpm libldb-1.1.25-2.el6_7.x86_64.rpm libldb-debuginfo-1.1.25-2.el6_7.i686.rpm libldb-debuginfo-1.1.25-2.el6_7.x86_64.rpm libldb-devel-1.1.25-2.el6_7.i686.rpm libldb-devel-1.1.25-2.el6_7.x86_64.rpm libtalloc-2.1.5-1.el6_7.i686.rpm libtalloc-2.1.5-1.el6_7.x86_64.rpm libtalloc-debuginfo-2.1.5-1.el6_7.i686.rpm libtalloc-debuginfo-2.1.5-1.el6_7.x86_64.rpm libtalloc-devel-2.1.5-1.el6_7.i686.rpm libtalloc-devel-2.1.5-1.el6_7.x86_64.rpm libtdb-1.3.8-1.el6_7.i686.rpm libtdb-1.3.8-1.el6_7.x86_64.rpm libtdb-debuginfo-1.3.8-1.el6_7.i686.rpm libtdb-debuginfo-1.3.8-1.el6_7.x86_64.rpm libtdb-devel-1.3.8-1.el6_7.i686.rpm libtdb-devel-1.3.8-1.el6_7.x86_64.rpm libtevent-0.9.26-2.el6_7.i686.rpm libtevent-0.9.26-2.el6_7.x86_64.rpm libtevent-debuginfo-0.9.26-2.el6_7.i686.rpm libtevent-debuginfo-0.9.26-2.el6_7.x86_64.rpm libtevent-devel-0.9.26-2.el6_7.i686.rpm libtevent-devel-0.9.26-2.el6_7.x86_64.rpm openchange-1.0-7.el6_7.x86_64.rpm openchange-debuginfo-1.0-7.el6_7.x86_64.rpm pyldb-1.1.25-2.el6_7.x86_64.rpm pytalloc-2.1.5-1.el6_7.x86_64.rpm python-tdb-1.3.8-1.el6_7.x86_64.rpm python-tevent-0.9.26-2.el6_7.x86_64.rpm samba4-4.2.10-6.el6_7.x86_64.rpm samba4-client-4.2.10-6.el6_7.x86_64.rpm samba4-common-4.2.10-6.el6_7.x86_64.rpm samba4-dc-4.2.10-6.el6_7.x86_64.rpm samba4-dc-libs-4.2.10-6.el6_7.x86_64.rpm samba4-debuginfo-4.2.10-6.el6_7.x86_64.rpm samba4-devel-4.2.10-6.el6_7.x86_64.rpm samba4-libs-4.2.10-6.el6_7.x86_64.rpm samba4-pidl-4.2.10-6.el6_7.x86_64.rpm samba4-python-4.2.10-6.el6_7.x86_64.rpm samba4-test-4.2.10-6.el6_7.x86_64.rpm samba4-winbind-4.2.10-6.el6_7.x86_64.rpm samba4-winbind-clients-4.2.10-6.el6_7.x86_64.rpm samba4-winbind-krb5-locator-4.2.10-6.el6_7.x86_64.rpm ipa-admintools-3.0.0-47.el6_7.2.x86_64.rpm ipa-server-3.0.0-47.el6_7.2.x86_64.rpm ipa-server-selinux-3.0.0-47.el6_7.2.x86_64.rpm ipa-server-trust-ad-3.0.0-47.el6_7.2.x86_64.rpm ldb-tools-1.1.25-2.el6_7.x86_64.rpm openchange-client-1.0-7.el6_7.x86_64.rpm openchange-devel-1.0-7.el6_7.x86_64.rpm openchange-devel-docs-1.0-7.el6_7.x86_64.rpm pyldb-devel-1.1.25-2.el6_7.x86_64.rpm pytalloc-devel-2.1.5-1.el6_7.x86_64.rpm tdb-tools-1.3.8-1.el6_7.x86_64.rpm i386 ipa-client-3.0.0-47.el6_7.2.i686.rpm ipa-debuginfo-3.0.0-47.el6_7.2.i686.rpm ipa-python-3.0.0-47.el6_7.2.i686.rpm libldb-1.1.25-2.el6_7.i686.rpm libldb-debuginfo-1.1.25-2.el6_7.i686.rpm libldb-devel-1.1.25-2.el6_7.i686.rpm libtalloc-2.1.5-1.el6_7.i686.rpm libtalloc-debuginfo-2.1.5-1.el6_7.i686.rpm libtalloc-devel-2.1.5-1.el6_7.i686.rpm libtdb-1.3.8-1.el6_7.i686.rpm libtdb-debuginfo-1.3.8-1.el6_7.i686.rpm libtdb-devel-1.3.8-1.el6_7.i686.rpm libtevent-0.9.26-2.el6_7.i686.rpm libtevent-debuginfo-0.9.26-2.el6_7.i686.rpm libtevent-devel-0.9.26-2.el6_7.i686.rpm openchange-1.0-7.el6_7.i686.rpm openchange-debuginfo-1.0-7.el6_7.i686.rpm pyldb-1.1.25-2.el6_7.i686.rpm pytalloc-2.1.5-1.el6_7.i686.rpm python-tdb-1.3.8-1.el6_7.i686.rpm python-tevent-0.9.26-2.el6_7.i686.rpm samba4-4.2.10-6.el6_7.i686.rpm samba4-client-4.2.10-6.el6_7.i686.rpm samba4-common-4.2.10-6.el6_7.i686.rpm samba4-dc-4.2.10-6.el6_7.i686.rpm samba4-dc-libs-4.2.10-6.el6_7.i686.rpm samba4-debuginfo-4.2.10-6.el6_7.i686.rpm samba4-devel-4.2.10-6.el6_7.i686.rpm samba4-libs-4.2.10-6.el6_7.i686.rpm samba4-pidl-4.2.10-6.el6_7.i686.rpm samba4-python-4.2.10-6.el6_7.i686.rpm samba4-test-4.2.10-6.el6_7.i686.rpm samba4-winbind-4.2.10-6.el6_7.i686.rpm samba4-winbind-clients-4.2.10-6.el6_7.i686.rpm samba4-winbind-krb5-locator-4.2.10-6.el6_7.i686.rpm ipa-admintools-3.0.0-47.el6_7.2.i686.rpm ipa-server-3.0.0-47.el6_7.2.i686.rpm ipa-server-selinux-3.0.0-47.el6_7.2.i686.rpm ipa-server-trust-ad-3.0.0-47.el6_7.2.i686.rpm ldb-tools-1.1.25-2.el6_7.i686.rpm openchange-client-1.0-7.el6_7.i686.rpm openchange-devel-1.0-7.el6_7.i686.rpm openchange-devel-docs-1.0-7.el6_7.i686.rpm pyldb-devel-1.1.25-2.el6_7.i686.rpm pytalloc-devel-2.1.5-1.el6_7.i686.rpm tdb-tools-1.3.8-1.el6_7.i686.rpm SL7 x86_64 ipa-client-4.2.0-15.el7_2.6.1.x86_64.rpm ipa-debuginfo-4.2.0-15.el7_2.6.1.x86_64.rpm ipa-python-4.2.0-15.el7_2.6.1.x86_64.rpm libldb-1.1.25-1.el7_2.i686.rpm libldb-1.1.25-1.el7_2.x86_64.rpm libldb-debuginfo-1.1.25-1.el7_2.i686.rpm libldb-debuginfo-1.1.25-1.el7_2.x86_64.rpm libsmbclient-4.2.10-6.el7_2.i686.rpm libsmbclient-4.2.10-6.el7_2.x86_64.rpm libtalloc-2.1.5-1.el7_2.i686.rpm libtalloc-2.1.5-1.el7_2.x86_64.rpm libtalloc-debuginfo-2.1.5-1.el7_2.i686.rpm libtalloc-debuginfo-2.1.5-1.el7_2.x86_64.rpm libtdb-1.3.8-1.el7_2.i686.rpm libtdb-1.3.8-1.el7_2.x86_64.rpm libtdb-debuginfo-1.3.8-1.el7_2.i686.rpm libtdb-debuginfo-1.3.8-1.el7_2.x86_64.rpm libtevent-0.9.26-1.el7_2.i686.rpm libtevent-0.9.26-1.el7_2.x86_64.rpm libtevent-debuginfo-0.9.26-1.el7_2.i686.rpm libtevent-debuginfo-0.9.26-1.el7_2.x86_64.rpm libwbclient-4.2.10-6.el7_2.i686.rpm libwbclient-4.2.10-6.el7_2.x86_64.rpm openchange-2.0-10.el7_2.i686.rpm openchange-2.0-10.el7_2.x86_64.rpm openchange-debuginfo-2.0-10.el7_2.i686.rpm openchange-debuginfo-2.0-10.el7_2.x86_64.rpm pytalloc-2.1.5-1.el7_2.i686.rpm pytalloc-2.1.5-1.el7_2.x86_64.rpm samba-client-4.2.10-6.el7_2.x86_64.rpm samba-client-libs-4.2.10-6.el7_2.i686.rpm samba-client-libs-4.2.10-6.el7_2.x86_64.rpm samba-common-libs-4.2.10-6.el7_2.x86_64.rpm samba-common-tools-4.2.10-6.el7_2.x86_64.rpm samba-debuginfo-4.2.10-6.el7_2.i686.rpm samba-debuginfo-4.2.10-6.el7_2.x86_64.rpm samba-libs-4.2.10-6.el7_2.i686.rpm samba-libs-4.2.10-6.el7_2.x86_64.rpm samba-winbind-4.2.10-6.el7_2.x86_64.rpm samba-winbind-clients-4.2.10-6.el7_2.x86_64.rpm samba-winbind-modules-4.2.10-6.el7_2.i686.rpm samba-winbind-modules-4.2.10-6.el7_2.x86_64.rpm ipa-admintools-4.2.0-15.el7_2.6.1.x86_64.rpm ipa-server-4.2.0-15.el7_2.6.1.x86_64.rpm ipa-server-dns-4.2.0-15.el7_2.6.1.x86_64.rpm ipa-server-trust-ad-4.2.0-15.el7_2.6.1.x86_64.rpm ldb-tools-1.1.25-1.el7_2.x86_64.rpm libldb-devel-1.1.25-1.el7_2.i686.rpm libldb-devel-1.1.25-1.el7_2.x86_64.rpm libsmbclient-devel-4.2.10-6.el7_2.i686.rpm libsmbclient-devel-4.2.10-6.el7_2.x86_64.rpm libtalloc-devel-2.1.5-1.el7_2.i686.rpm libtalloc-devel-2.1.5-1.el7_2.x86_64.rpm libtdb-devel-1.3.8-1.el7_2.i686.rpm libtdb-devel-1.3.8-1.el7_2.x86_64.rpm libtevent-devel-0.9.26-1.el7_2.i686.rpm libtevent-devel-0.9.26-1.el7_2.x86_64.rpm libwbclient-devel-4.2.10-6.el7_2.i686.rpm libwbclient-devel-4.2.10-6.el7_2.x86_64.rpm openchange-client-2.0-10.el7_2.x86_64.rpm openchange-devel-2.0-10.el7_2.i686.rpm openchange-devel-2.0-10.el7_2.x86_64.rpm pyldb-1.1.25-1.el7_2.i686.rpm pyldb-1.1.25-1.el7_2.x86_64.rpm pyldb-devel-1.1.25-1.el7_2.i686.rpm pyldb-devel-1.1.25-1.el7_2.x86_64.rpm pytalloc-devel-2.1.5-1.el7_2.i686.rpm pytalloc-devel-2.1.5-1.el7_2.x86_64.rpm python-tdb-1.3.8-1.el7_2.i686.rpm python-tdb-1.3.8-1.el7_2.x86_64.rpm python-tevent-0.9.26-1.el7_2.x86_64.rpm samba-4.2.10-6.el7_2.x86_64.rpm samba-dc-4.2.10-6.el7_2.x86_64.rpm samba-dc-libs-4.2.10-6.el7_2.x86_64.rpm samba-devel-4.2.10-6.el7_2.i686.rpm samba-devel-4.2.10-6.el7_2.x86_64.rpm samba-python-4.2.10-6.el7_2.x86_64.rpm samba-test-4.2.10-6.el7_2.x86_64.rpm samba-test-devel-4.2.10-6.el7_2.x86_64.rpm samba-test-libs-4.2.10-6.el7_2.i686.rpm samba-test-libs-4.2.10-6.el7_2.x86_64.rpm samba-vfs-glusterfs-4.2.10-6.el7_2.x86_64.rpm samba-winbind-krb5-locator-4.2.10-6.el7_2.x86_64.rpm tdb-tools-1.3.8-1.el7_2.x86_64.rpm noarch samba-common-4.2.10-6.el7_2.noarch.rpm openchange-devel-docs-2.0-10.el7_2.noarch.rpm samba-pidl-4.2.10-6.el7_2.noarch.rpm - Scientific Linux Development Team . Important samba and samba4 vulnerabilities identified in Scientific Linux with accompanying remediation steps and update guidelines.. samba security issues, Scientific Linux updates, samba vulnerabilities, security advisory, samba bug fix. . Severity: Critical. LinuxSecurity.com Team
Apr 12, 2016
•Critical
Scientific Linux
98
security advisoryupdatesambaRed Hat Enterprise Linux: RHSA-2016-0625-01 High: Samba Protocol Flaws
An update for samba is now available for Red Hat Enterprise Linux 4 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: samba security update Advisory ID: RHSA-2016:0625-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2016:0625.html Issue date: 2016-04-12 CVE Names: CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2115 CVE-2016-2118 ==================================================================== 1. Summary: An update for samba is now available for Red Hat Enterprise Linux 4 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (v. 4 ELS) - i386, ia64, x86_64 Red Hat Enterprise Linux ES (v. 4 ELS) - i386, x86_64 3. Description: Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server. As a result, theattacker would be able to get read/write access to the Security Account Manager database, and use this to reveal all passwords or any other potentially sensitive information in that database. (CVE-2016-2118) * Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection. (CVE-2016-2110) * It was discovered that Samba configured as a Domain Controller would establish a secure communication channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111) * It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections. (CVE-2016-2112) * It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client. (CVE-2016-2115) Red Hat would like to thank the Samba project for reporting these issues. Upstream acknowledges Stefan Metzmacher (SerNet) as the original reporter of CVE-2016-2118, CVE-2016-2110, CVE-2016-2112, and CVE-2016-2115. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, the smb service will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1311893 - CVE-2016-2110 samba: Man-in-the-middle attacks possible with NTLMSSPauthentication 1311902 - CVE-2016-2111 samba: Spoofing vulnerability when domain controller is configured 1311903 - CVE-2016-2112 samba: Missing downgrade detection 1312084 - CVE-2016-2115 samba: Smb signing not required by default when smb client connection is used for ipc usage 1317990 - CVE-2016-2118 samba: SAMR and LSA man in the middle attacks 6. Package List: Red Hat Enterprise Linux AS (v. 4 ELS): Source: samba-3.0.33-3.37.el4.src.rpm i386: samba-3.0.33-3.37.el4.i386.rpm samba-client-3.0.33-3.37.el4.i386.rpm samba-common-3.0.33-3.37.el4.i386.rpm samba-debuginfo-3.0.33-3.37.el4.i386.rpm samba-swat-3.0.33-3.37.el4.i386.rpm ia64: samba-3.0.33-3.37.el4.ia64.rpm samba-client-3.0.33-3.37.el4.ia64.rpm samba-common-3.0.33-3.37.el4.i386.rpm samba-common-3.0.33-3.37.el4.ia64.rpm samba-debuginfo-3.0.33-3.37.el4.i386.rpm samba-debuginfo-3.0.33-3.37.el4.ia64.rpm samba-swat-3.0.33-3.37.el4.ia64.rpm x86_64: samba-3.0.33-3.37.el4.x86_64.rpm samba-client-3.0.33-3.37.el4.x86_64.rpm samba-common-3.0.33-3.37.el4.i386.rpm samba-common-3.0.33-3.37.el4.x86_64.rpm samba-debuginfo-3.0.33-3.37.el4.i386.rpm samba-debuginfo-3.0.33-3.37.el4.x86_64.rpm samba-swat-3.0.33-3.37.el4.x86_64.rpm Red Hat Enterprise Linux ES (v. 4 ELS): Source: samba-3.0.33-3.37.el4.src.rpm i386: samba-3.0.33-3.37.el4.i386.rpm samba-client-3.0.33-3.37.el4.i386.rpm samba-common-3.0.33-3.37.el4.i386.rpm samba-debuginfo-3.0.33-3.37.el4.i386.rpm samba-swat-3.0.33-3.37.el4.i386.rpm x86_64: samba-3.0.33-3.37.el4.x86_64.rpm samba-client-3.0.33-3.37.el4.x86_64.rpm samba-common-3.0.33-3.37.el4.i386.rpm samba-common-3.0.33-3.37.el4.x86_64.rpm samba-debuginfo-3.0.33-3.37.el4.i386.rpm samba-debuginfo-3.0.33-3.37.el4.x86_64.rpm samba-swat-3.0.33-3.37.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7.References: https://access.redhat.com/security/cve/CVE-2016-2110 https://access.redhat.com/security/cve/CVE-2016-2111 https://access.redhat.com/security/cve/CVE-2016-2112 https://access.redhat.com/security/cve/CVE-2016-2115 https://access.redhat.com/security/cve/CVE-2016-2118 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/security/vulnerabilities/badlock https://access.redhat.com/articles/2253041 https://samba.plus https://access.redhat.com/articles/2243351 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXDWt/XlSAg2UNWIIRAkJwAKCmf+NjM/zGdtYJ4v4AeEOp3XG2pgCeOd0T 7WUsQE0oTDuSC8D+58bRrcw=f4Ey -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Apr 12, 2016
•Important
Red Hat
87
security advisorycriticaldebianDebian: DSA-2141-2 Critical Update: NSS SSL/TLS Protocol Flaw
CVE-2009-3555: Marsh Ray, Steve Dispensa, and Martin Rex discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle . - ------------------------------------------------------------------------ Debian Security Advisory DSA-2141-2
Jan 05, 2011
•Critical
Debian
87
security advisorydebianremote attackDebian: DSA-2141-1 Critical: OpenSSL Insecure Renegotiation Threat
CVE-2009-3555: Marsh Ray, Steve Dispensa, and Martin Rex discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle . - ------------------------------------------------------------------------ Debian Security Advisory DSA-2141-1
Jan 05, 2011
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!