: Log in!


ウェブ 検索
トップ  >  Linux15歩  >  2015-02-27 sambaのupdate
20150227 samba-3.6.25にupdateしました

Release Notes for Samba 3.6.25 February 23, 2015

. CVE-2015-0240:
  All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an
  unexpected code execution vulnerability in the smbd file server

  A malicious client could send packets that may set up the stack in
  such a way that the freeing of memory in a subsequent anonymous
  netlogon packet could allow execution of arbitrary code. This code
  would execute with root privileges.

. CVE-2014-0178:
  In preparing a response to an authenticated FSCTL_GET_SHADOW_COPY_DATA
  or FSCTL_SRV_ENUMERATE_SNAPSHOTS client request, affected versions of
  Samba do not initialize 8 bytes of the 16 byte SRV_SNAPSHOT_ARRAY
  response field. The uninitialized buffer is sent back to the client.

  A non-default VFS module providing the get_shadow_copy_data_fn() hook
  must be explicitly enabled for Samba to process the aforementioned
  client requests. Therefore, only configurations with "shadow_copy" or
  "shadow_copy2" specified for the "vfs objects" parameter are vulnerable.

Changes since 3.6.24:

. Jeremy Allison <jra at samba.org>
  * BUG 11077: CVE-2015-0240: talloc free on uninitialized stack pointer
  in netlogon server could lead to security vulnerability.

. Jiří Šašek <jiri.sasek at oracle.com>
  * BUG 10549: CVE-2014-0178: Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS

. Andreas Schneider <asn at samba.org>
  * BUG 11077: CVE-2015-0240: s3-netlogon: Make sure we do not deference
  a NULL pointer./auth: Make sure that creds_out is initialized with NULL.
投票数:39 平均点:5.13
2015-02-22 phpmyadminのupdate
2015-03-01 bindのupdate