RHSA-2016:0624 Samba Critical Security Update (Badlock, CVE-2016-2118, etc.)

From this webpage screenshot, the following key vulnerability information can be extracted: Security Advisory ID: RHSA-2016:0624 Release Date: 2016-04-12 Update Date: 2016-04-12 Summary: Critical: samba3x security update Type/Severity: Security Advisory: Critical Subject: Updates for samba3x are now available for Red Hat Enterprise Linux 5.6 Long Life and Red Hat Enterprise Linux 5.9 Long Life. Red Hat Product Security has rated the security impact of this update as critical. Vulnerabilities Fixed: - Multiple flaws were found in the DCE/RPC protocol implementation in Samba. A remote, authenticated attacker could exploit these flaws to cause a denial of service (high CPU load or crash) against a Samba server, or potentially execute arbitrary code with the privileges of the user running Samba (root). - Protocol flaws, publicly known as Badlock, were discovered in the implementation of the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated DCE/RPC connection initiated by a client to a server could be exploited by a man-in-the-middle attacker, who might impersonate an authenticated user. - Several flaws were found in the NTLMSSP authentication implementation in Samba. An unauthenticated man-in-the-middle attacker could exploit this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plaintext. The attacker could also force the client or server to send data in plaintext, even if encryption was explicitly requested for the connection. - It was discovered that Samba configured as a domain controller would use a forged computer name to establish a secure communication channel with a machine. A remote attacker capable of observing network traffic could exploit this flaw to obtain session-related information about the forged machine. - It was found that Samba’s LDAP implementation does not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could exploit this flaw to downgrade LDAP connections to use no integrity protection, thereby allowing hijacking of such connections. - It was discovered that Samba does not allow integrity protection for IPC traffic. A man-in-the-middle attacker could exploit this flaw to view and modify data sent between Samba servers and clients. Solution: Refer to the provided links for detailed instructions. Affected Products: - Red Hat Enterprise Linux Server - AUS 5.9 x86_64 - Red Hat Enterprise Linux Server - AUS 5.9 ia64 - Red Hat Enterprise Linux Server - AUS 5.9 i386 - Red Hat Enterprise Linux Server - AUS 5.6 x86_64 - Red Hat Enterprise Linux Server - AUS 5.6 ia64 - Red Hat Enterprise Linux Server - AUS 5.6 i386 Bugzilla Reports Corresponding to Fixes: - BZ - 1309987: CVE-2015-5370 samba: Missing error checking in dcesrv_auth_bind_ack leads to crash - BZ - 1311893: CVE-2016-2110 samba: NTLMSSP authentication may be vulnerable to man-in-the-middle attacks - BZ - 1311902: CVE-2016-2111 samba: Spoofing vulnerability when domain controller is configured to be enabled - BZ - 1311903: CVE-2016-2112 samba: Downgrade attack not detected - BZ - 1312084: CVE-2016-2115 samba: SMB signing not required when SMB client connects for IPC use - BZ - 1317990: CVE-2016-2118 samba: Man-in-the-middle attack in SAMR and LSA CVE IDs: - CVE-2015-5370 - CVE-2016-2115 - CVE-2016-2112 - CVE-2016-2118 - CVE-2016-2111 - CVE-2016-2110 Reference Links: - https://access.redhat.com/security/updates/classification/#critical - https://access.redhat.com/security/vulnerabilities/badlock - https://access.redhat.com/articles/2253041 - http://badlock.org/ - https://access.redhat.com/articles/2243351/

Goal Reached Thanks to every supporter — we hit 100%!

RHSA-2016:0624 Samba Critical Security Update (Badlock, CVE-2016-2118, etc.)