Security update for samba SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:3300-1 Final 1 1 2016-12-29T19:46:53Z current 2016-12-29T19:46:53Z 2016-12-29T19:46:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for samba This update for samba provides the following fixes: Security issues fixed: - CVE-2016-2125: Don't send delegated credentials to all servers. (bsc#1014441) - CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. (bsc#1014442) Non security issues fixed: - Allow SESSION KEY setup without signing. (bsc#1009711) - Fix crash bug in tevent_queue_immediate_trigger(). (bsc#1003731) - Don't fail when using default domain with user@domain.com format. (bsc#997833) - Prevent core, make sure response->extra_data.data is always cleared out. (bsc#993692) - Honor smb.conf socket options in winbind. (bsc#975131) - Fix crash with net rpc join. (bsc#978898) - Fix a regression verifying the security trailer. (bsc#978898) - Fix updating netlogon credentials. (bsc#978898) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp2-samba-12925 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20163300-1/ Link for SUSE-SU-2016:3300-1 https://lists.suse.com/pipermail/sle-security-updates/2016-December/002536.html E-Mail link for SUSE-SU-2016:3300-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1003731 SUSE Bug 1003731 https://bugzilla.suse.com/1009711 SUSE Bug 1009711 https://bugzilla.suse.com/1014441 SUSE Bug 1014441 https://bugzilla.suse.com/1014442 SUSE Bug 1014442 https://bugzilla.suse.com/975131 SUSE Bug 975131 https://bugzilla.suse.com/978898 SUSE Bug 978898 https://bugzilla.suse.com/993692 SUSE Bug 993692 https://bugzilla.suse.com/997833 SUSE Bug 997833 https://www.suse.com/security/cve/CVE-2016-2125/ SUSE CVE CVE-2016-2125 page https://www.suse.com/security/cve/CVE-2016-2126/ SUSE CVE CVE-2016-2126 page SUSE Linux Enterprise Server 11 SP2-LTSS ldapsmb-1.34b-56.1 libldb1-3.6.3-56.1 libsmbclient0-3.6.3-56.1 libsmbclient0-32bit-3.6.3-56.1 libtalloc2-3.6.3-56.1 libtalloc2-32bit-3.6.3-56.1 libtdb1-3.6.3-56.1 libtdb1-32bit-3.6.3-56.1 libtevent0-3.6.3-56.1 libtevent0-32bit-3.6.3-56.1 libwbclient0-3.6.3-56.1 libwbclient0-32bit-3.6.3-56.1 samba-3.6.3-56.1 samba-32bit-3.6.3-56.1 samba-client-3.6.3-56.1 samba-client-32bit-3.6.3-56.1 samba-doc-3.6.3-56.1 samba-krb-printing-3.6.3-56.1 samba-winbind-3.6.3-56.1 samba-winbind-32bit-3.6.3-56.1 ldapsmb-1.34b-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libldb1-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libsmbclient0-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libsmbclient0-32bit-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libtalloc2-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libtalloc2-32bit-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libtdb1-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libtdb1-32bit-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libtevent0-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libtevent0-32bit-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libwbclient0-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS libwbclient0-32bit-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS samba-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS samba-32bit-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS samba-client-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS samba-client-32bit-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS samba-doc-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS samba-krb-printing-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS samba-winbind-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS samba-winbind-32bit-3.6.3-56.1 as a component of SUSE Linux Enterprise Server 11 SP2-LTSS It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users. CVE-2016-2125 SUSE Linux Enterprise Server 11 SP2-LTSS:ldapsmb-1.34b-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libldb1-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libsmbclient0-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libsmbclient0-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtalloc2-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtalloc2-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtdb1-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtdb1-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtevent0-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtevent0-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libwbclient0-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libwbclient0-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-client-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-client-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-doc-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-krb-printing-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-winbind-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-winbind-32bit-3.6.3-56.1 low 2.9 AV:A/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20163300-1/ https://www.suse.com/security/cve/CVE-2016-2125.html CVE-2016-2125 https://bugzilla.suse.com/1014441 SUSE Bug 1014441 Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions. CVE-2016-2126 SUSE Linux Enterprise Server 11 SP2-LTSS:ldapsmb-1.34b-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libldb1-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libsmbclient0-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libsmbclient0-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtalloc2-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtalloc2-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtdb1-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtdb1-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtevent0-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libtevent0-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libwbclient0-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:libwbclient0-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-client-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-client-32bit-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-doc-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-krb-printing-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-winbind-3.6.3-56.1 SUSE Linux Enterprise Server 11 SP2-LTSS:samba-winbind-32bit-3.6.3-56.1 low 2.3 AV:A/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20163300-1/ https://www.suse.com/security/cve/CVE-2016-2126.html CVE-2016-2126 https://bugzilla.suse.com/1014442 SUSE Bug 1014442