samba-3.6.23-24.AXS4
エラータID: AXSA:2016-013:01
リリース日:
2016/01/08 Friday - 11:43
題名:
samba-3.6.23-24.AXS4
影響のあるチャネル:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- Samba の AD LDAP サーバで使用される ldb の ldb_match.c の
ldb_wildcard_compare 関数は，0 の値を誤って処理しており，リモートの
攻撃者がサービス拒否 (無限ループ) を引き起こす脆弱性があります。
(CVE-2015-3223)
- Samba の smbd の vfs.c には，特定のサブ文字列の関係をもった共有名が
存在する場合，共有の外部を示すシンボリックリンクによって，リモートの
攻撃者が意図されたファイルアクセス制限を回避する脆弱性があります。
(CVE-2015-5252)
- Samba は暗号化されてはいるものの，署名されていない接続をサポートして
おり，クライアント-サーバ間のデータストリームを改変することにより，暗号
化された通信から暗号化されない通信へのダウングレードを行う脆弱性がありま
す。(CVE-2015-5296)
- Samba の modules/vfs_shadow_copy2.c の
shadow_copy2_get_shadow_copy_data 関数は，DIRECTORY_LIST アクセス権
が許可されることを適切に検証しておらず，シャドウコピーディレクトリを
訪れることによって，リモートの攻撃者がスナップショットにアクセスでき
る脆弱性があります。(CVE-2015-5299)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2015-5252
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
CVE-2015-5296
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unencrypted downgrade attacks by modifying the client-server data stream, related to clidfs.c, libsmb_server.c, and smbXcli_base.c.
CVE-2015-5299
The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory.
The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not verify that the DIRECTORY_LIST access right has been granted, which allows remote attackers to access snapshots by visiting a shadow copy directory.
追加情報:
N/A
ダウンロード:
SRPMS
- samba-3.6.23-24.AXS4.src.rpm
MD5: 7abf74209e0d9df9db93ed035e201240
SHA-256: e2bf6fb96f5a58e9d7895040488ea4e4ec248e0032b7c3cdc6901744683914dd
Size: 28.27 MB
Asianux Server 4 for x86
- libsmbclient-3.6.23-24.AXS4.i686.rpm
MD5: 44c8d4f9949c3ff690411e874a6a1e63
SHA-256: 74f1f0fff4b727b7d5a26093be68454cbf2bd1fcf1f98307d630c671f5a2f024
Size: 1.56 MB - samba-3.6.23-24.AXS4.i686.rpm
MD5: 5eefd623d25fcc6623ff62ea087ce7ee
SHA-256: 6b8239f7660311dac1ede45f876e8a23fe10fb2dfbbd990a58fa5f94b3f5fa2f
Size: 5.03 MB - samba-client-3.6.23-24.AXS4.i686.rpm
MD5: bd9ad71f20e49a659c2c32e80fe48f72
SHA-256: c633fd34db6032b8326657ad9cb06d837448c46378c3478b441e3bfa098db157
Size: 10.68 MB - samba-common-3.6.23-24.AXS4.i686.rpm
MD5: 42fe0da02e5cff1c852fcf73525343fa
SHA-256: 7003d5f71875bac2d75ba4086d24198f848940d95399484c2ef8c8c06b6bc2e1
Size: 9.93 MB - samba-winbind-3.6.23-24.AXS4.i686.rpm
MD5: 3e78b5b673cdb0e224972f341a119790
SHA-256: 8c44d88a77e64b3eb0d18014948c54eb071eb30a3b63459f2ceef02f23663f30
Size: 2.15 MB - samba-winbind-clients-3.6.23-24.AXS4.i686.rpm
MD5: 235a8f27062eb140d7f5d80585408b11
SHA-256: dcf6ea5e2e6515a1f149dfb57d33c80dc8a0c9902d42bcecf74d3f34703927db
Size: 1.99 MB
Asianux Server 4 for x86_64
- libsmbclient-3.6.23-24.AXS4.x86_64.rpm
MD5: e04723c86b11e2a1a80f32496b1ce8de
SHA-256: 44b0392d0ba1046f23da312e1bd877f00e89878851fce24144617f62f0aeb1b6
Size: 1.58 MB - samba-3.6.23-24.AXS4.x86_64.rpm
MD5: 7e4d80688c22e638a65b3d0bc5631549
SHA-256: 72e0f57172868342a669af51d3a5adbc8f1fd93969c6ffab289023d61dc3b5ad
Size: 5.02 MB - samba-client-3.6.23-24.AXS4.x86_64.rpm
MD5: 9665108a45374307b1b8bd67c32c524e
SHA-256: 930489ef64547a95774f65928e9ee33dc215f9bf6a37a44949dad59b6c0a56b7
Size: 10.76 MB - samba-common-3.6.23-24.AXS4.x86_64.rpm
MD5: 199ee16398985dba63aa8d3e71637fdc
SHA-256: 3984f848d61b3f4917a3a1cba73d59597b5beab821355c0161f70425ac4c5a94
Size: 9.97 MB - samba-winbind-3.6.23-24.AXS4.x86_64.rpm
MD5: feb97a0a77472ef012b04d9e22c4aa14
SHA-256: 5e9d603bc974880f651f4e7024fa402afd1068bc8b643b149a7a67450e90f05c
Size: 2.16 MB - samba-winbind-clients-3.6.23-24.AXS4.x86_64.rpm
MD5: 012ff059830ad635ec6177d64abc2b94
SHA-256: e89e243febfd68112d83756e3727935d02c2d317533dbf14db95a701b169355c
Size: 1.99 MB - libsmbclient-3.6.23-24.AXS4.i686.rpm
MD5: 44c8d4f9949c3ff690411e874a6a1e63
SHA-256: 74f1f0fff4b727b7d5a26093be68454cbf2bd1fcf1f98307d630c671f5a2f024
Size: 1.56 MB - samba-common-3.6.23-24.AXS4.i686.rpm
MD5: 42fe0da02e5cff1c852fcf73525343fa
SHA-256: 7003d5f71875bac2d75ba4086d24198f848940d95399484c2ef8c8c06b6bc2e1
Size: 9.93 MB - samba-winbind-clients-3.6.23-24.AXS4.i686.rpm
MD5: 235a8f27062eb140d7f5d80585408b11
SHA-256: dcf6ea5e2e6515a1f149dfb57d33c80dc8a0c9902d42bcecf74d3f34703927db
Size: 1.99 MB
English