Red Hat Security AdvisoryRHSA-2017:2789
samba security update
Released 2017-09-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) libsmbclient-3.6.23-45.el6_9, samba-3.6.23-45.el6_9, samba-client-3.6.23-45.el6_9 +3
- Red Hat Enterprise Linux Desktop Optional (v. 6) libsmbclient-devel-3.6.23-45.el6_9, samba-3.6.23-45.el6_9, samba-doc-3.6.23-45.el6_9 +5
- Red Hat Enterprise Linux HPC Node (v. 6) samba-3.6.23-45.el6_9, samba-client-3.6.23-45.el6_9, samba-common-3.6.23-45.el6_9 +2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) libsmbclient-3.6.23-45.el6_9, libsmbclient-devel-3.6.23-45.el6_9, samba-3.6.23-45.el6_9 +6
- Red Hat Enterprise Linux Server (v. 6) libsmbclient-3.6.23-45.el6_9, libsmbclient-3.6.23-45.el6_9.ppc, samba-3.6.23-45.el6_9 +6
- Red Hat Enterprise Linux Server Optional (v. 6) libsmbclient-devel-3.6.23-45.el6_9, libsmbclient-devel-3.6.23-45.el6_9.ppc, samba-doc-3.6.23-45.el6_9 +6
- Red Hat Enterprise Linux Workstation (v. 6) libsmbclient-3.6.23-45.el6_9, samba-3.6.23-45.el6_9, samba-client-3.6.23-45.el6_9 +3
- Red Hat Enterprise Linux Workstation Optional (v. 6) libsmbclient-devel-3.6.23-45.el6_9, samba-doc-3.6.23-45.el6_9, samba-domainjoin-gui-3.6.23-45.el6_9 +4
Fixes 3 records
Priority MEDIUM 47
It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.13065 · Published 2018-07-26 · Partial fix CWE-300
Priority MEDIUM 46
Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.1102 · Published 2018-03-12 · Partial fix CWE-362
Priority MEDIUM 42
An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8.
CVSS 3.0HIGH 7.1· Adjacent network · No auth · No interaction · EPSS 0.0759 · Published 2018-07-26 · Partial fix CWE-200
