Red Hat Security AdvisoryRHSA-2013:1542
samba security, bug fix, and enhancement update
Released 2013-11-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) libsmbclient-3.6.9-164.el6, samba-3.6.9-164.el6, samba-client-3.6.9-164.el6 +3
- Red Hat Enterprise Linux Desktop Optional (v. 6) libsmbclient-devel-3.6.9-164.el6, samba-3.6.9-164.el6, samba-doc-3.6.9-164.el6 +4
- Red Hat Enterprise Linux HPC Node (v. 6) samba-3.6.9-164.el6, samba-client-3.6.9-164.el6, samba-common-3.6.9-164.el6 +2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) libsmbclient-3.6.9-164.el6, libsmbclient-devel-3.6.9-164.el6, samba-3.6.9-164.el6 +5
- Red Hat Enterprise Linux Server (v. 6) libsmbclient-3.6.9-164.el6, libsmbclient-3.6.9-164.el6.ppc, samba-3.6.9-164.el6 +6
- Red Hat Enterprise Linux Server Optional (v. 6) libsmbclient-devel-3.6.9-164.el6, libsmbclient-devel-3.6.9-164.el6.ppc, samba-3.6.9-164.el6 +6
- Red Hat Enterprise Linux Workstation (v. 6) libsmbclient-3.6.9-164.el6, samba-3.6.9-164.el6, samba-client-3.6.9-164.el6 +3
- Red Hat Enterprise Linux Workstation Optional (v. 6) libsmbclient-devel-3.6.9-164.el6, samba-3.6.9-164.el6, samba-doc-3.6.9-164.el6 +4
Fixes 3 records
Priority MEDIUM 60
Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) v…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.69008 · Published 2013-08-05 · Fixed CWE-189
Priority LOW 29
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
CVSS 2.0MEDIUM 5.1· Network · No auth · Interaction — · EPSS 0.03248 · Published 2013-02-02 · Fixed CWE-20
Priority LOW 27
Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of ar…
CVSS 2.0MEDIUM 5.1· Network · No auth · Interaction — · EPSS 0.01906 · Published 2013-02-02 · Fixed CWE-352
THREATIST.IORead the docs