보안 정보 / 2018 / 보안 정보 -- DSA-4345-1 samba

데비안 보안 권고

DSA-4345-1 samba -- 보안 업데이트

보고일:

2018년 11월 27일

영향 받는 패키지:

samba

위험성:

예

보안 데이터베이스 참조:

Mitre의 CVE 사전: CVE-2018-14629, CVE-2018-16841, CVE-2018-16851.

추가 정보:

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues:

• CVE-2018-14629

  Florian Stuelpner discovered that Samba is vulnerable to infinite query recursion caused by CNAME loops, resulting in denial of service.

  https://www.samba.org/samba/security/CVE-2018-14629.html

• CVE-2018-16841

  Alex MacCuish discovered that a user with a valid certificate or smart card can crash the Samba AD DC's KDC when configured to accept smart-card authentication.

  https://www.samba.org/samba/security/CVE-2018-16841.html

• CVE-2018-16851

  Garming Sam of the Samba Team and Catalyst discovered a NULL pointer dereference vulnerability in the Samba AD DC LDAP server allowing a user able to read more than 256MB of LDAP entries to crash the Samba AD DC's LDAP server.

  https://www.samba.org/samba/security/CVE-2018-16851.html

안정 버전(stretch)에서, 이 문제를 버전 2:4.5.12+dfsg-2+deb9u4에서 고쳤습니다.

samba 패키지를 업그레이드 하는 게 좋습니다.

samba의 자세한 보안 상태는 보안 추적 페이지 참조: https://security-tracker.debian.org/tracker/samba