Skip to content
OpenAdvisories
Medium ELSA-2016-0006 5 CVEs

Moderate: samba security update (Oracle Linux 7)

Published Jan 7, 2016 · Updated Jan 7, 2016

Ecosystem: Oracle Linux

Summary

[4.2.3-11]
- resolves: #1290710
- CVE-2015-3223 Remote DoS in Samba (AD) LDAP server
- CVE-2015-5299 Missing access control check in shadow copy code
- CVE-2015-5252 Insufficient symlink verification in smbd
- CVE-2015-5296 Samba client requesting encryption vulnerable to
downgrade attack

Fixed packages 24

ReleasePackageFixed in
Oracle Linux · 7 libsmbclient 0:4.2.3-11.el7_2
Oracle Linux · 7 libsmbclient-devel 0:4.2.3-11.el7_2
Oracle Linux · 7 libwbclient 0:4.2.3-11.el7_2
Oracle Linux · 7 libwbclient-devel 0:4.2.3-11.el7_2
Oracle Linux · 7 samba 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-client 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-client-libs 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-common 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-common-libs 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-common-tools 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-dc 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-dc-libs 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-devel 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-libs 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-pidl 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-python 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-test 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-test-devel 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-test-libs 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-vfs-glusterfs 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-winbind 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-winbind-clients 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-winbind-krb5-locator 0:4.2.3-11.el7_2
Oracle Linux · 7 samba-winbind-modules 0:4.2.3-11.el7_2

Vulnerabilities 5

  • Unscored —
    CVE-2015-3223

    The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x befor…

    samba samba ldb Debian Ubuntu
  • Unscored —
    CVE-2015-5252 EPSS 13%

    vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with cer…

    samba samba Debian Ubuntu
  • Unscored —
    CVE-2015-5296

    Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but…

    samba samba Debian Ubuntu
  • Unscored —
    CVE-2015-5299 EPSS 14%

    The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x …

    samba samba Debian Ubuntu
  • Unscored —
    CVE-2015-7540

    The LDAP server in the AD domain controller in Samba 4.x before 4.1.22 does not check return values to ensure successfu…

    samba samba Debian Ubuntu