[RHSA-2016:1486-01] Moderate: samba security and bug fix update

[news 28]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

=====================================================================

Red Hat Security Advisory

 

Synopsis: Moderate: samba security and bug fix update

Advisory ID: RHSA-2016:1486-01

Product: Red Hat Enterprise Linux

Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1486.html

Issue date: 2016-07-26

CVE Names: CVE-2016-2119

=====================================================================

 

1. Summary:

 

An update for samba is now available for Red Hat Enterprise Linux 7.

 

Red Hat Product Security has rated this update as having a security impact

of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

gives a detailed severity rating, is available for each vulnerability from

the CVE link(s) in the References section.

 

2. Relevant releases/architectures:

 

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Resilient Storage (v. 7) - x86_64

Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch, x86_64

 

3. Description:

 

Samba is an open-source implementation of the Server Message Block (SMB)

protocol and the related Common Internet File System (CIFS) protocol, which

allow PC-compatible machines to share files, printers, and various

information.

 

Security Fix(es):

 

* A flaw was found in the way Samba initiated signed DCE/RPC connections. A

man-in-the-middle attacker could use this flaw to downgrade the connection

to not use signing and therefore impersonate the server. (CVE-2016-2119)

 

Red Hat would like to thank the Samba project for reporting this issue.

Upstream acknowledges Stefan Metzmacher as the original reporter.

 

Bug Fix(es):

 

* Previously, the "net" command in some cases failed to join the client to

Active Directory (AD) because the permissions setting prevented

modification of the supported Kerberos encryption type LDAP attribute. With

this update, Samba has been fixed to allow joining an AD domain as a user.

In addition, Samba now uses the machine account credentials to set up the

Kerberos encryption types within AD for the joined machine. As a result,

using "net" to join a domain now works more reliably. (BZ#1351260)

 

* Previously, the idmap_hash module worked incorrectly when it was used

together with other modules. As a consequence, user and group IDs were not

mapped properly. A patch has been applied to skip already configured

modules. Now, the hash module can be used as the default idmap

configuration back end and IDs are resolved correctly. (BZ#1350759)

 

4. Solution:

 

For details on how to apply this update, which includes the changes

described in this advisory, refer to:

 

https://access.redhat.com/articles/11258

 

After installing this update, the smb service will be restarted

automatically.

 

5. Bugs fixed (https://bugzilla.redhat.com/):

 

1350759 - idmap_hash module works incorrectly when used with other backend modules

1351260 - net ads join throws "Failed to join domain: failed to set machine kerberos encryption types: Insufficient access"

1351955 - CVE-2016-2119 samba: Client side SMB2/3 required signing can be downgraded

 

6. Package List:

 

Red Hat Enterprise Linux Client (v. 7):

 

Source:

samba-4.2.10-7.el7_2.src.rpm

 

noarch:

samba-common-4.2.10-7.el7_2.noarch.rpm

 

x86_64:

libsmbclient-4.2.10-7.el7_2.i686.rpm

libsmbclient-4.2.10-7.el7_2.x86_64.rpm

libwbclient-4.2.10-7.el7_2.i686.rpm

libwbclient-4.2.10-7.el7_2.x86_64.rpm

samba-client-4.2.10-7.el7_2.x86_64.rpm

samba-client-libs-4.2.10-7.el7_2.i686.rpm

samba-client-libs-4.2.10-7.el7_2.x86_64.rpm

samba-common-libs-4.2.10-7.el7_2.x86_64.rpm

samba-common-tools-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

samba-libs-4.2.10-7.el7_2.i686.rpm

samba-libs-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-clients-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-modules-4.2.10-7.el7_2.i686.rpm

samba-winbind-modules-4.2.10-7.el7_2.x86_64.rpm

 

Red Hat Enterprise Linux Client Optional (v. 7):

 

noarch:

samba-pidl-4.2.10-7.el7_2.noarch.rpm

 

x86_64:

libsmbclient-devel-4.2.10-7.el7_2.i686.rpm

libsmbclient-devel-4.2.10-7.el7_2.x86_64.rpm

libwbclient-devel-4.2.10-7.el7_2.i686.rpm

libwbclient-devel-4.2.10-7.el7_2.x86_64.rpm

samba-4.2.10-7.el7_2.x86_64.rpm

samba-dc-4.2.10-7.el7_2.x86_64.rpm

samba-dc-libs-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

samba-devel-4.2.10-7.el7_2.i686.rpm

samba-devel-4.2.10-7.el7_2.x86_64.rpm

samba-python-4.2.10-7.el7_2.x86_64.rpm

samba-test-4.2.10-7.el7_2.x86_64.rpm

samba-test-devel-4.2.10-7.el7_2.x86_64.rpm

samba-test-libs-4.2.10-7.el7_2.i686.rpm

samba-test-libs-4.2.10-7.el7_2.x86_64.rpm

samba-vfs-glusterfs-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-krb5-locator-4.2.10-7.el7_2.x86_64.rpm

 

Red Hat Enterprise Linux ComputeNode (v. 7):

 

Source:

samba-4.2.10-7.el7_2.src.rpm

 

noarch:

samba-common-4.2.10-7.el7_2.noarch.rpm

 

x86_64:

libsmbclient-4.2.10-7.el7_2.i686.rpm

libsmbclient-4.2.10-7.el7_2.x86_64.rpm

libwbclient-4.2.10-7.el7_2.i686.rpm

libwbclient-4.2.10-7.el7_2.x86_64.rpm

samba-client-4.2.10-7.el7_2.x86_64.rpm

samba-client-libs-4.2.10-7.el7_2.i686.rpm

samba-client-libs-4.2.10-7.el7_2.x86_64.rpm

samba-common-libs-4.2.10-7.el7_2.x86_64.rpm

samba-common-tools-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

samba-libs-4.2.10-7.el7_2.i686.rpm

samba-libs-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-clients-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-modules-4.2.10-7.el7_2.i686.rpm

samba-winbind-modules-4.2.10-7.el7_2.x86_64.rpm

 

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

 

noarch:

samba-pidl-4.2.10-7.el7_2.noarch.rpm

 

x86_64:

libsmbclient-devel-4.2.10-7.el7_2.i686.rpm

libsmbclient-devel-4.2.10-7.el7_2.x86_64.rpm

libwbclient-devel-4.2.10-7.el7_2.i686.rpm

libwbclient-devel-4.2.10-7.el7_2.x86_64.rpm

samba-4.2.10-7.el7_2.x86_64.rpm

samba-dc-4.2.10-7.el7_2.x86_64.rpm

samba-dc-libs-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

samba-devel-4.2.10-7.el7_2.i686.rpm

samba-devel-4.2.10-7.el7_2.x86_64.rpm

samba-python-4.2.10-7.el7_2.x86_64.rpm

samba-test-4.2.10-7.el7_2.x86_64.rpm

samba-test-devel-4.2.10-7.el7_2.x86_64.rpm

samba-test-libs-4.2.10-7.el7_2.i686.rpm

samba-test-libs-4.2.10-7.el7_2.x86_64.rpm

samba-vfs-glusterfs-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-krb5-locator-4.2.10-7.el7_2.x86_64.rpm

 

Red Hat Enterprise Linux Server (v. 7):

 

Source:

samba-4.2.10-7.el7_2.src.rpm

 

noarch:

samba-common-4.2.10-7.el7_2.noarch.rpm

 

ppc64:

libsmbclient-4.2.10-7.el7_2.ppc.rpm

libsmbclient-4.2.10-7.el7_2.ppc64.rpm

libwbclient-4.2.10-7.el7_2.ppc.rpm

libwbclient-4.2.10-7.el7_2.ppc64.rpm

samba-4.2.10-7.el7_2.ppc64.rpm

samba-client-4.2.10-7.el7_2.ppc64.rpm

samba-client-libs-4.2.10-7.el7_2.ppc.rpm

samba-client-libs-4.2.10-7.el7_2.ppc64.rpm

samba-common-libs-4.2.10-7.el7_2.ppc64.rpm

samba-common-tools-4.2.10-7.el7_2.ppc64.rpm

samba-debuginfo-4.2.10-7.el7_2.ppc.rpm

samba-debuginfo-4.2.10-7.el7_2.ppc64.rpm

samba-libs-4.2.10-7.el7_2.ppc.rpm

samba-libs-4.2.10-7.el7_2.ppc64.rpm

samba-winbind-4.2.10-7.el7_2.ppc64.rpm

samba-winbind-clients-4.2.10-7.el7_2.ppc64.rpm

samba-winbind-modules-4.2.10-7.el7_2.ppc.rpm

samba-winbind-modules-4.2.10-7.el7_2.ppc64.rpm

 

ppc64le:

libsmbclient-4.2.10-7.el7_2.ppc64le.rpm

libwbclient-4.2.10-7.el7_2.ppc64le.rpm

samba-4.2.10-7.el7_2.ppc64le.rpm

samba-client-4.2.10-7.el7_2.ppc64le.rpm

samba-client-libs-4.2.10-7.el7_2.ppc64le.rpm

samba-common-libs-4.2.10-7.el7_2.ppc64le.rpm

samba-common-tools-4.2.10-7.el7_2.ppc64le.rpm

samba-debuginfo-4.2.10-7.el7_2.ppc64le.rpm

samba-libs-4.2.10-7.el7_2.ppc64le.rpm

samba-winbind-4.2.10-7.el7_2.ppc64le.rpm

samba-winbind-clients-4.2.10-7.el7_2.ppc64le.rpm

samba-winbind-modules-4.2.10-7.el7_2.ppc64le.rpm

 

s390x:

libsmbclient-4.2.10-7.el7_2.s390.rpm

libsmbclient-4.2.10-7.el7_2.s390x.rpm

libwbclient-4.2.10-7.el7_2.s390.rpm

libwbclient-4.2.10-7.el7_2.s390x.rpm

samba-4.2.10-7.el7_2.s390x.rpm

samba-client-4.2.10-7.el7_2.s390x.rpm

samba-client-libs-4.2.10-7.el7_2.s390.rpm

samba-client-libs-4.2.10-7.el7_2.s390x.rpm

samba-common-libs-4.2.10-7.el7_2.s390x.rpm

samba-common-tools-4.2.10-7.el7_2.s390x.rpm

samba-debuginfo-4.2.10-7.el7_2.s390.rpm

samba-debuginfo-4.2.10-7.el7_2.s390x.rpm

samba-libs-4.2.10-7.el7_2.s390.rpm

samba-libs-4.2.10-7.el7_2.s390x.rpm

samba-winbind-4.2.10-7.el7_2.s390x.rpm

samba-winbind-clients-4.2.10-7.el7_2.s390x.rpm

samba-winbind-modules-4.2.10-7.el7_2.s390.rpm

samba-winbind-modules-4.2.10-7.el7_2.s390x.rpm

 

x86_64:

libsmbclient-4.2.10-7.el7_2.i686.rpm

libsmbclient-4.2.10-7.el7_2.x86_64.rpm

libwbclient-4.2.10-7.el7_2.i686.rpm

libwbclient-4.2.10-7.el7_2.x86_64.rpm

samba-4.2.10-7.el7_2.x86_64.rpm

samba-client-4.2.10-7.el7_2.x86_64.rpm

samba-client-libs-4.2.10-7.el7_2.i686.rpm

samba-client-libs-4.2.10-7.el7_2.x86_64.rpm

samba-common-libs-4.2.10-7.el7_2.x86_64.rpm

samba-common-tools-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

samba-libs-4.2.10-7.el7_2.i686.rpm

samba-libs-4.2.10-7.el7_2.x86_64.rpm

samba-python-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-clients-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-modules-4.2.10-7.el7_2.i686.rpm

samba-winbind-modules-4.2.10-7.el7_2.x86_64.rpm

 

Red Hat Enterprise Linux Server Resilient Storage (v. 7):

 

x86_64:

ctdb-4.2.10-7.el7_2.x86_64.rpm

ctdb-devel-4.2.10-7.el7_2.i686.rpm

ctdb-devel-4.2.10-7.el7_2.x86_64.rpm

ctdb-tests-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

 

Red Hat Enterprise Linux Server Optional (v. 7):

 

noarch:

samba-pidl-4.2.10-7.el7_2.noarch.rpm

 

ppc64:

libsmbclient-devel-4.2.10-7.el7_2.ppc.rpm

libsmbclient-devel-4.2.10-7.el7_2.ppc64.rpm

libwbclient-devel-4.2.10-7.el7_2.ppc.rpm

libwbclient-devel-4.2.10-7.el7_2.ppc64.rpm

samba-dc-4.2.10-7.el7_2.ppc64.rpm

samba-dc-libs-4.2.10-7.el7_2.ppc64.rpm

samba-debuginfo-4.2.10-7.el7_2.ppc.rpm

samba-debuginfo-4.2.10-7.el7_2.ppc64.rpm

samba-devel-4.2.10-7.el7_2.ppc.rpm

samba-devel-4.2.10-7.el7_2.ppc64.rpm

samba-python-4.2.10-7.el7_2.ppc64.rpm

samba-test-4.2.10-7.el7_2.ppc64.rpm

samba-test-devel-4.2.10-7.el7_2.ppc64.rpm

samba-test-libs-4.2.10-7.el7_2.ppc.rpm

samba-test-libs-4.2.10-7.el7_2.ppc64.rpm

samba-winbind-krb5-locator-4.2.10-7.el7_2.ppc64.rpm

 

ppc64le:

libsmbclient-devel-4.2.10-7.el7_2.ppc64le.rpm

libwbclient-devel-4.2.10-7.el7_2.ppc64le.rpm

samba-dc-4.2.10-7.el7_2.ppc64le.rpm

samba-dc-libs-4.2.10-7.el7_2.ppc64le.rpm

samba-debuginfo-4.2.10-7.el7_2.ppc64le.rpm

samba-devel-4.2.10-7.el7_2.ppc64le.rpm

samba-python-4.2.10-7.el7_2.ppc64le.rpm

samba-test-4.2.10-7.el7_2.ppc64le.rpm

samba-test-devel-4.2.10-7.el7_2.ppc64le.rpm

samba-test-libs-4.2.10-7.el7_2.ppc64le.rpm

samba-winbind-krb5-locator-4.2.10-7.el7_2.ppc64le.rpm

 

s390x:

libsmbclient-devel-4.2.10-7.el7_2.s390.rpm

libsmbclient-devel-4.2.10-7.el7_2.s390x.rpm

libwbclient-devel-4.2.10-7.el7_2.s390.rpm

libwbclient-devel-4.2.10-7.el7_2.s390x.rpm

samba-dc-4.2.10-7.el7_2.s390x.rpm

samba-dc-libs-4.2.10-7.el7_2.s390x.rpm

samba-debuginfo-4.2.10-7.el7_2.s390.rpm

samba-debuginfo-4.2.10-7.el7_2.s390x.rpm

samba-devel-4.2.10-7.el7_2.s390.rpm

samba-devel-4.2.10-7.el7_2.s390x.rpm

samba-python-4.2.10-7.el7_2.s390x.rpm

samba-test-4.2.10-7.el7_2.s390x.rpm

samba-test-devel-4.2.10-7.el7_2.s390x.rpm

samba-test-libs-4.2.10-7.el7_2.s390.rpm

samba-test-libs-4.2.10-7.el7_2.s390x.rpm

samba-winbind-krb5-locator-4.2.10-7.el7_2.s390x.rpm

 

x86_64:

libsmbclient-devel-4.2.10-7.el7_2.i686.rpm

libsmbclient-devel-4.2.10-7.el7_2.x86_64.rpm

libwbclient-devel-4.2.10-7.el7_2.i686.rpm

libwbclient-devel-4.2.10-7.el7_2.x86_64.rpm

samba-dc-4.2.10-7.el7_2.x86_64.rpm

samba-dc-libs-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

samba-devel-4.2.10-7.el7_2.i686.rpm

samba-devel-4.2.10-7.el7_2.x86_64.rpm

samba-test-4.2.10-7.el7_2.x86_64.rpm

samba-test-devel-4.2.10-7.el7_2.x86_64.rpm

samba-test-libs-4.2.10-7.el7_2.i686.rpm

samba-test-libs-4.2.10-7.el7_2.x86_64.rpm

samba-vfs-glusterfs-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-krb5-locator-4.2.10-7.el7_2.x86_64.rpm

 

Red Hat Enterprise Linux Workstation (v. 7):

 

Source:

samba-4.2.10-7.el7_2.src.rpm

 

noarch:

samba-common-4.2.10-7.el7_2.noarch.rpm

 

x86_64:

libsmbclient-4.2.10-7.el7_2.i686.rpm

libsmbclient-4.2.10-7.el7_2.x86_64.rpm

libwbclient-4.2.10-7.el7_2.i686.rpm

libwbclient-4.2.10-7.el7_2.x86_64.rpm

samba-4.2.10-7.el7_2.x86_64.rpm

samba-client-4.2.10-7.el7_2.x86_64.rpm

samba-client-libs-4.2.10-7.el7_2.i686.rpm

samba-client-libs-4.2.10-7.el7_2.x86_64.rpm

samba-common-libs-4.2.10-7.el7_2.x86_64.rpm

samba-common-tools-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

samba-libs-4.2.10-7.el7_2.i686.rpm

samba-libs-4.2.10-7.el7_2.x86_64.rpm

samba-python-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-clients-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-modules-4.2.10-7.el7_2.i686.rpm

samba-winbind-modules-4.2.10-7.el7_2.x86_64.rpm

 

Red Hat Enterprise Linux Workstation Optional (v. 7):

 

noarch:

samba-pidl-4.2.10-7.el7_2.noarch.rpm

 

x86_64:

libsmbclient-devel-4.2.10-7.el7_2.i686.rpm

libsmbclient-devel-4.2.10-7.el7_2.x86_64.rpm

libwbclient-devel-4.2.10-7.el7_2.i686.rpm

libwbclient-devel-4.2.10-7.el7_2.x86_64.rpm

samba-dc-4.2.10-7.el7_2.x86_64.rpm

samba-dc-libs-4.2.10-7.el7_2.x86_64.rpm

samba-debuginfo-4.2.10-7.el7_2.i686.rpm

samba-debuginfo-4.2.10-7.el7_2.x86_64.rpm

samba-devel-4.2.10-7.el7_2.i686.rpm

samba-devel-4.2.10-7.el7_2.x86_64.rpm

samba-test-4.2.10-7.el7_2.x86_64.rpm

samba-test-devel-4.2.10-7.el7_2.x86_64.rpm

samba-test-libs-4.2.10-7.el7_2.i686.rpm

samba-test-libs-4.2.10-7.el7_2.x86_64.rpm

samba-vfs-glusterfs-4.2.10-7.el7_2.x86_64.rpm

samba-winbind-krb5-locator-4.2.10-7.el7_2.x86_64.rpm

 

These packages are GPG signed by Red Hat for security. Our key and

details on how to verify the signature are available from

https://access.redhat.com/security/team/key/

 

7. References:

 

https://access.redhat.com/security/cve/CVE-2016-2119

https://access.redhat.com/security/updates/classification/#moderate

 

8. Contact:

 

The Red Hat security contact is . More contact

details at https://access.redhat.com/security/team/contact/

 

Copyright 2016 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1

 

iD8DBQFXlxEMXlSAg2UNWIIRAlZAAKC1hl0gqvxb7ZKizUAriO5UyAIo7gCdGMK2

8F1JVtz58jP53g1rBc+/mlw=

=FQCp

-----END PGP SIGNATURE-----

 

 

--