Oval Definition:oval:org.opensuse.security:def:1576
Revision Date:2021-11-10Version:1
Title:Security update for samba and ldb (Important)
Description:

This update for samba and ldb fixes the following issues:

- CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246). - CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215). - CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440). - CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284). - CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247). - CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283). - CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214). - CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).

Samba was updated to 4.13.13

rodc_rwdc test flaps;(bso#14868). * Backport bronze bit fixes, tests, and selftest improvements; (bso#14881). * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal;(bso#14642). * Python ldb.msg_diff() memory handling failure;(bso#14836). * 'in' operator on ldb.Message is case sensitive;(bso#14845). * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871). * Allow special chars like '@' in samAccountName when generating the salt;(bso#14874). * Fix transit path validation;(bso#12998). * Prepare to operate with MIT krb5 >= 1.20;(bso#14870). * rpcclient NetFileEnum and net rpc file both cause lock order violation: brlock.tdb, share_entries.tdb;(bso#14645). * Python ldb.msg_diff() memory handling failure;(bso#14836). * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).

Samba was updated to 4.13.12:

Address a signifcant performance regression in database access in the AD DC since Samba 4.12;(bso#14806). * Fix performance regression in lsa_LookupSids3/LookupNames4 since Samba 4.9 by using an explicit database handle cache; (bso#14807). * An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817). * Address flapping samba_tool_drs_showrepl test;(bso#14818). * Address flapping dsdb_schema_attributes test;(bso#14819). * An unuthenticated user can crash the AD DC KDC by omitting the server name in a TGS-REQ;(bso#14817). * Fix CTDB flag/status update race conditions(bso#14784).

Samba was updated to 4.13.11:

smbd: panic on force-close share during offload write; (bso#14769). * Fix returned attributes on fake quota file handle and avoid hitting the VFS;(bso#14731). * smbd: 'deadtime' parameter doesn't work anymore;(bso#14783). * net conf list crashes when run as normal user;(bso#14787). * Work around special SMB2 READ response behavior of NetApp Ontap 7.3.7;(bso#14607). * Start the SMB encryption as soon as possible;(bso#14793). * Winbind should not start if the socket path for the privileged pipe is too long;(bso#14792).

ldb was updated to 2.2.2:

+ CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558) + CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)

Release ldb 2.2.2

+ Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845). + Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836) + Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).
Family:unixClass:patch
Status:Reference(s):1014440
1128106
1133031
1134883
1135210
1135902
1136540
1136778
1138534
1140402
1143794
1144087
1192214
1192215
1192246
1192247
1192283
1192284
1192505
CVE-2016-10214
CVE-2016-2124
CVE-2017-5937
CVE-2017-5957
CVE-2017-5993
CVE-2017-5994
CVE-2017-6386
CVE-2019-12155
CVE-2019-12155
CVE-2019-13164
CVE-2019-13164
CVE-2019-14378
CVE-2019-14378
CVE-2019-15142
CVE-2019-15143
CVE-2019-15144
CVE-2019-15145
CVE-2019-18804
CVE-2019-5008
CVE-2019-5008
CVE-2020-25717
CVE-2020-25718
CVE-2020-25719
CVE-2020-25721
CVE-2020-25722
CVE-2021-23192
CVE-2021-3738
SUSE-SU-2019:2192-1
SUSE-SU-2021:3647-1
Platform(s):SUSE Linux Enterprise Desktop 11 SP2
SUSE Linux Enterprise Desktop 11 SP3
SUSE Linux Enterprise Desktop 12 SP1
SUSE Linux Enterprise Desktop 12 SP2
SUSE Linux Enterprise Desktop 12 SP3
SUSE Linux Enterprise Desktop 15 SP2
SUSE Linux Enterprise Desktop 15 SP3
SUSE Linux Enterprise High Availability 15
SUSE Linux Enterprise High Performance Computing 15 SP2
SUSE Linux Enterprise High Performance Computing 15 SP3
SUSE Linux Enterprise Module for Basesystem 15 SP1
SUSE Linux Enterprise Module for Containers 15
SUSE Linux Enterprise Module for Containers 15 SP1
SUSE Linux Enterprise Module for Desktop Applications 15
SUSE Linux Enterprise Module for Desktop Applications 15 SP1
SUSE Linux Enterprise Module for Desktop Applications 15 SP2
SUSE Linux Enterprise Module for Development Tools 15
SUSE Linux Enterprise Module for Development Tools 15 SP1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
SUSE Linux Enterprise Module for Python 2 15 SP3
SUSE Linux Enterprise Module for Server Applications 15
SUSE Linux Enterprise Module for Server Applications 15 SP1
SUSE Linux Enterprise Module for Web Scripting 15
SUSE Linux Enterprise Server 11-SECURITY
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 12 SP1
SUSE Linux Enterprise Server 12 SP2
SUSE Linux Enterprise Server 12-LTSS
SUSE Linux Enterprise Server 15 SP2
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15 SP2
SUSE Linux Enterprise Server for SAP Applications 15 SP3
SUSE Linux Enterprise Software Development Kit 11 SP2
SUSE Linux Enterprise Software Development Kit 11 SP3
SUSE Linux Enterprise Software Development Kit 11 SP4
SUSE Linux Enterprise Storage 7
SUSE Linux Enterprise Storage 7.1
SUSE Manager Proxy 4.1
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.2
SUSE Manager Server 4.1
SUSE Manager Server 4.2
Product(s):
Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP1 is installed
  • AND Package Information
  • dia-0.97.2-13 is installed
  • OR dia-lang-0.97.2-13 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP2 is installed
  • AND Package Information
  • aaa_base-13.2+git20140911.61c1681-28 is installed
  • OR aaa_base-extras-13.2+git20140911.61c1681-28 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP3 is installed
  • AND Package Information
  • DirectFB-1.7.1-6 is installed
  • OR lib++dfb-1_7-1-1.7.1-6 is installed
  • OR libdirectfb-1_7-1-1.7.1-6 is installed
  • OR libdirectfb-1_7-1-32bit-1.7.1-6 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Desktop Applications 15 SP2 is installed
  • AND Package Information
  • libdjvulibre-devel-3.5.27-9.28 is installed
  • OR libdjvulibre21-3.5.27-9.28 is installed
    • Definition Synopsis
  • Release Information
  • SUSE Linux Enterprise Desktop 15 SP3 is installed
  • OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed
  • OR SUSE Linux Enterprise Module for Python 2 15 SP3 is installed
  • OR SUSE Linux Enterprise Server 15 SP3 is installed
  • OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed
  • OR SUSE Linux Enterprise Storage 7.1 is installed
  • OR SUSE Manager Proxy 4.2 is installed
  • OR SUSE Manager Retail Branch Server 4.2 is installed
  • OR SUSE Manager Server 4.2 is installed
  • AND samba-ad-dc-4.13.13+git.528.140935f8d6a-3.12.1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise High Availability 15 is installed
  • AND Package Information
  • cluster-md-kmp-default-4.12.14-25.19 is installed
  • OR dlm-kmp-default-4.12.14-25.19 is installed
  • OR gfs2-kmp-default-4.12.14-25.19 is installed
  • OR kernel-default-4.12.14-25.19 is installed
  • OR ocfs2-kmp-default-4.12.14-25.19 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Basesystem 15 SP1 is installed
  • AND Package Information
  • qemu-3.1.1-9.3 is installed
  • OR qemu-tools-3.1.1-9.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Containers 15 is installed
  • AND helm-mirror-0.2.1-1.7 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Containers 15 SP1 is installed
  • AND Package Information
  • containerd-1.2.5-5.13 is installed
  • OR docker-18.09.6_ce-6.17 is installed
  • OR docker-bash-completion-18.09.6_ce-6.17 is installed
  • OR docker-libnetwork-0.7.0.1+gitr2726_872f0a83c98a-4.12 is installed
  • OR docker-runc-1.0.0rc6+gitr3804_2b18fe1d885e-6.18 is installed
  • OR golang-github-docker-libnetwork-0.7.0.1+gitr2726_872f0a83c98a-4.12 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Desktop Applications 15 is installed
  • AND Package Information
  • libtiff5-32bit-4.0.9-5.9 is installed
  • OR tiff-4.0.9-5.9 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Desktop Applications 15 SP1 is installed
  • AND Package Information
  • typelib-1_0-JavaScriptCore-4_0-2.24.2-3.27 is installed
  • OR typelib-1_0-WebKit2-4_0-2.24.2-3.27 is installed
  • OR typelib-1_0-WebKit2WebExtension-4_0-2.24.2-3.27 is installed
  • OR webkit2gtk3-2.24.2-3.27 is installed
  • OR webkit2gtk3-devel-2.24.2-3.27 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Development Tools 15 is installed
  • AND Package Information
  • git-2.16.4-3.3 is installed
  • OR git-arch-2.16.4-3.3 is installed
  • OR git-cvs-2.16.4-3.3 is installed
  • OR git-daemon-2.16.4-3.3 is installed
  • OR git-doc-2.16.4-3.3 is installed
  • OR git-email-2.16.4-3.3 is installed
  • OR git-gui-2.16.4-3.3 is installed
  • OR git-svn-2.16.4-3.3 is installed
  • OR git-web-2.16.4-3.3 is installed
  • OR gitk-2.16.4-3.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Development Tools 15 SP1 is installed
  • AND Package Information
  • graphviz-addons-2.40.1-6.3 is installed
  • OR graphviz-perl-2.40.1-6.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 is installed
  • AND Package Information
  • kernel-default-4.12.14-25.25 is installed
  • OR kernel-default-base-4.12.14-25.25 is installed
  • OR kernel-docs-4.12.14-25.25 is installed
  • OR kernel-docs-html-4.12.14-25.25 is installed
  • OR kernel-obs-qa-4.12.14-25.25 is installed
  • OR kselftests-kmp-default-4.12.14-25.25 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Server Applications 15 is installed
  • AND Package Information
  • apache2-2.4.33-3.9 is installed
  • OR apache2-devel-2.4.33-3.9 is installed
  • OR apache2-doc-2.4.33-3.9 is installed
  • OR apache2-prefork-2.4.33-3.9 is installed
  • OR apache2-utils-2.4.33-3.9 is installed
  • OR apache2-worker-2.4.33-3.9 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Server Applications 15 SP1 is installed
  • AND Package Information
  • libvirglrenderer0-0.6.0-2 is installed
  • OR virglrenderer-devel-0.6.0-2 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Module for Web Scripting 15 is installed
  • AND Package Information
  • apache2-mod_php7-7.2.5-4.46 is installed
  • OR php7-7.2.5-4.46 is installed
  • OR php7-bcmath-7.2.5-4.46 is installed
  • OR php7-bz2-7.2.5-4.46 is installed
  • OR php7-calendar-7.2.5-4.46 is installed
  • OR php7-ctype-7.2.5-4.46 is installed
  • OR php7-curl-7.2.5-4.46 is installed
  • OR php7-dba-7.2.5-4.46 is installed
  • OR php7-devel-7.2.5-4.46 is installed
  • OR php7-dom-7.2.5-4.46 is installed
  • OR php7-enchant-7.2.5-4.46 is installed
  • OR php7-exif-7.2.5-4.46 is installed
  • OR php7-fastcgi-7.2.5-4.46 is installed
  • OR php7-fileinfo-7.2.5-4.46 is installed
  • OR php7-fpm-7.2.5-4.46 is installed
  • OR php7-ftp-7.2.5-4.46 is installed
  • OR php7-gd-7.2.5-4.46 is installed
  • OR php7-gettext-7.2.5-4.46 is installed
  • OR php7-gmp-7.2.5-4.46 is installed
  • OR php7-iconv-7.2.5-4.46 is installed
  • OR php7-intl-7.2.5-4.46 is installed
  • OR php7-json-7.2.5-4.46 is installed
  • OR php7-ldap-7.2.5-4.46 is installed
  • OR php7-mbstring-7.2.5-4.46 is installed
  • OR php7-mysql-7.2.5-4.46 is installed
  • OR php7-odbc-7.2.5-4.46 is installed
  • OR php7-opcache-7.2.5-4.46 is installed
  • OR php7-openssl-7.2.5-4.46 is installed
  • OR php7-pcntl-7.2.5-4.46 is installed
  • OR php7-pdo-7.2.5-4.46 is installed
  • OR php7-pear-7.2.5-4.46 is installed
  • OR php7-pear-Archive_Tar-7.2.5-4.46 is installed
  • OR php7-pgsql-7.2.5-4.46 is installed
  • OR php7-phar-7.2.5-4.46 is installed
  • OR php7-posix-7.2.5-4.46 is installed
  • OR php7-shmop-7.2.5-4.46 is installed
  • OR php7-snmp-7.2.5-4.46 is installed
  • OR php7-soap-7.2.5-4.46 is installed
  • OR php7-sockets-7.2.5-4.46 is installed
  • OR php7-sodium-7.2.5-4.46 is installed
  • OR php7-sqlite-7.2.5-4.46 is installed
  • OR php7-sysvmsg-7.2.5-4.46 is installed
  • OR php7-sysvsem-7.2.5-4.46 is installed
  • OR php7-sysvshm-7.2.5-4.46 is installed
  • OR php7-tokenizer-7.2.5-4.46 is installed
  • OR php7-wddx-7.2.5-4.46 is installed
  • OR php7-xmlreader-7.2.5-4.46 is installed
  • OR php7-xmlrpc-7.2.5-4.46 is installed
  • OR php7-xmlwriter-7.2.5-4.46 is installed
  • OR php7-xsl-7.2.5-4.46 is installed
  • OR php7-zip-7.2.5-4.46 is installed
  • OR php7-zlib-7.2.5-4.46 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP1 is installed
  • AND Package Information
  • libruby2_1-2_1-2.1.2-9 is installed
  • OR ruby2.1-2.1.2-9 is installed
  • OR ruby2.1-stdlib-2.1.2-9 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2 is installed
  • AND Package Information
  • python-cupshelpers-1.5.7-7.5 is installed
  • OR system-config-printer-1.5.7-7.5 is installed
  • OR system-config-printer-common-1.5.7-7.5 is installed
  • OR system-config-printer-common-lang-1.5.7-7.5 is installed
  • OR system-config-printer-dbus-service-1.5.7-7.5 is installed
  • OR udev-configure-printer-1.5.7-7.5 is installed
    • BACK