Samba - Security Update
Summary
DSA-3514-1: samba - security update. Affects samba versions < 2:3.6.6-6+deb7u7. Fixed in 2:3.6.6-6+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Samba is an open-source SMB/CIFS file, print, and login server for Unix systems. It provides file and printer sharing services to Windows clients and allows Unix clients to access shared files and printers on Windows systems. Samba is widely used in both home and enterprise environments.
Vulnerability Detail
The Samba package is affected by multiple vulnerabilities:
-
CVE-2015-7560: This vulnerability allows an authenticated malicious client to create a symlink to a file or directory using SMB1 UNIX extensions and then overwrite the ACL (Access Control List) on the linked file or directory.
-
CVE-2016-0771: If Samba is deployed as an Active Directory Domain Controller (AD DC) with the internal DNS server enabled, it is vulnerable to an out-of-bounds read issue during DNS TXT record handling. This vulnerability can be exploited by a remote attacker to cause a denial of service (Samba crash) or potentially leak memory from the server in the form of a DNS TXT reply.
How To Fix
Minimum fixed version
2:3.6.6-6+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade sambaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is advised to apply the recommended package updates.
Conclusion
Upgrading the Samba package to the recommended versions will address the identified vulnerabilities. It is crucial to keep software up to date to ensure the security and integrity of your system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for samba →
FAQ
Samba is an open-source implementation of the SMB/CIFS networking protocol. It allows Unix systems to provide file and printer sharing services to Windows clients.
CVE-2015-7560 allows an authenticated malicious client to manipulate ACLs on symlinks, potentially leading to unauthorized access or modification of files and directories.
You can check the version of Samba installed on your system by running the command 'smbd -V' or 'samba -V' in the terminal.
This report specifically addresses the vulnerabilities identified as CVE-2015-7560 and CVE-2016-0771. However, it is always recommended to keep your software up to date to mitigate any potential security risks.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-3514-1. The advisory provides detailed information about the vulnerabilities and their fixes.
Related vulnerabilities
Recent vulnerabilities recorded for samba.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
