openSUSE Security Update : samba (openSUSE-SU-2013:1921-1)

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

- Update to 4.1.3.

+ DCE-RPC fragment length field is incorrectly checked;
CVE-2013-4408; (bnc#844720).

+ pam_winbind login without require_membership_of
restrictions; CVE-2012-6150; (bnc#853347).

- Make use of the full gpg pub key file name including the
key ID.

- Add transparent file compression support; (fate#316266).

+ Implement FSCTL_GET_COMPRESSION and
FSCTL_SET_COMPRESSION handlers.

+ Add FILE_ATTRIBUTE_COMPRESSED and FILE_NO_COMPRESSION
support.

+ Extend vfs_btrfs VFS module to utilize get/set
compression hooks.

- Add support for FSCTL_SRV_COPYCHUNK_WRITE;
(fate#314770).

- Remove bogus libsmbclient0 package description and
cleanup the libsmbclient line from baselibs.conf;
(bnc#853021).

- BuildRequire systemd on post-12.2 systems.

- Update to 4.1.2.

+ s4-dns: dlz_bind9: Create dns-HOSTNAME account disabled;
(bso#9091).

+ dfs_server: Use dsdb_search_one to catch 0 results as
well as NO_SUCH_OBJECT errors; (bso#10052).

+ Missing talloc_free can leak stackframe in error path;
(bso#10187).

+ Fix memset used with constant zero length parameter;
(bso#10190).

+ s4:dsdb/rootdse: report 'dnsHostName' instead of
'dNSHostName'; (bso#10193).

+ Make offline logon cache updating for cross child domain
group membership; (bso#10194).

+ nsswitch: Fix short writes in winbind_write_sock;
(bso#10195).

+ RW Deny for a specific user is not overriding RW Allow
for a group; (bso#10196).

+ vfs_glusterfs: Fix excessive debug output from
vfs_gluster_open(); (bso#10224).

+ vfs_glusterfs: Implement proper mashalling/unmarshalling
of ACLs; (bso#10224).

+ VFS plugin was sending the actual size of the volume
instead of the total number of block units because of
which windows was getting the wrong 	 volume
capacity; (bso#10224).

+ libcli/smb: Fix smb2cli_ioctl*() against Windows 2008;
(bso#10232).

+ xattr: Fix listing EAs on *BSD for non-root users;
(bso#10247).

+ Fix the build of vfs_glusterfs; (bso#10253).

+ s3-winbindd: Fix cache_traverse_validate_fn failure for
NDR cache entries; (bso#10264).

+ util: Remove 32bit macros breaking strict aliasing;
(bso#10269).

- Let gpg verify execution condition not fail on non SUSE
systems.

- Add systemd support for post-12.2 systems.

- Update to 4.1.1.

+ ACLs are not checked on opening an alternate data stream
on a file or directory; CVE-2013-4475; (bso#10229);
(bnc#848101).

+ Private key in key.pem world readable; CVE-2013-4476;
(bnc#848103).

See also :

http://lists.opensuse.org/opensuse-updates/2013-12/msg00088.html
https://bugzilla.novell.com/show_bug.cgi?id=844720
https://bugzilla.novell.com/show_bug.cgi?id=848101
https://bugzilla.novell.com/show_bug.cgi?id=848103
https://bugzilla.novell.com/show_bug.cgi?id=853021
https://bugzilla.novell.com/show_bug.cgi?id=853347

Solution :

Update the affected samba packages.

Risk factor :

High / CVSS Base Score : 8.3
(CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C)

Family: SuSE Local Security Checks

Nessus Plugin ID: 75242 ()

Bugtraq ID:

CVE ID: CVE-2012-6150
CVE-2013-4408
CVE-2013-4475
CVE-2013-4476

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now