SUSE-SU-2016:1105-1: important: Security update for samba

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for samba
______________________________________________________________________________

Announcement ID:    SUSE-SU-2016:1105-1
Rating:             important
References:         #913087 #958582 #973031 #973032 
Cross-References:   CVE-2015-5252 CVE-2016-2110 CVE-2016-2111
                   
Affected Products:
                    SUSE Linux Enterprise Server 10 SP4 LTSS
______________________________________________________________________________

   An update that solves three vulnerabilities and has one
   errata is now available.

Description:


   Samba was updated to fix three security issues.

   These security issues were fixed:

       * CVE-2016-2110: A man-in-the-middle could have downgraded NTLMSSP
         authentication (bso#11688, bsc#973031).
       * CVE-2016-2111: Domain controller netlogon member computer could have
         been spoofed (bso#11749, bsc#973032).
       * CVE-2015-5252: Insufficient symlink verification (allowed file access
         outside the share) (bso#11395, bnc#958582).

   This non-security issue was fixed:

       * Allow "delete readonly = yes" to correctly override deletion of a
         file (bsc#913087, bso#5073)

   Security Issues:

       * CVE-2016-2110
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2110>
       * CVE-2016-2111
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2111>
       * CVE-2015-5252
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5252>

Contraindications:




Package List:

   - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64):

      cifs-mount-3.0.36-0.13.32.1
      ldapsmb-1.34b-25.13.32.1
      libmsrpc-3.0.36-0.13.32.1
      libmsrpc-devel-3.0.36-0.13.32.1
      libsmbclient-3.0.36-0.13.32.1
      libsmbclient-devel-3.0.36-0.13.32.1
      samba-3.0.36-0.13.32.1
      samba-client-3.0.36-0.13.32.1
      samba-krb-printing-3.0.36-0.13.32.1
      samba-python-3.0.36-0.13.32.1
      samba-vscan-0.3.6b-43.13.32.1
      samba-winbind-3.0.36-0.13.32.1

   - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64):

      libsmbclient-32bit-3.0.36-0.13.32.1
      samba-32bit-3.0.36-0.13.32.1
      samba-client-32bit-3.0.36-0.13.32.1
      samba-winbind-32bit-3.0.36-0.13.32.1

   - SUSE Linux Enterprise Server 10 SP4 LTSS (noarch):

      samba-doc-3.0.36-0.12.32.1


References:

   https://www.suse.com/security/cve/CVE-2015-5252.html
   https://www.suse.com/security/cve/CVE-2016-2110.html
   https://www.suse.com/security/cve/CVE-2016-2111.html
   https://bugzilla.suse.com/913087
   https://bugzilla.suse.com/958582
   https://bugzilla.suse.com/973031
   https://bugzilla.suse.com/973032
   https://download.suse.com/patch/finder/?keywords=7a8b86525db490aaf0868ada97807c68