Samba 4.1.1

Naviga SWZ: Home Page » News
News del 11 Novembre 13 Autore: Gianplugged
Samba 4.1.1
Samba è un software open source che permette di ottenere interoperabilità tra Linux, Unix, Mac OS X e Windows.

Note di rilascio:

This is a security release in order to address
CVE-2013-4475 (ACLs are not checked on opening an alternate
data stream on a file or directory) and
CVE-2013-4476 (Private key in key.pem world readable).

o CVE-2013-4475:
Samba versions 3.2.0 and above (all versions of 3.2.x, 3.3.x,
3.4.x, 3.5.x, 3.6.x, 4.0.x and 4.1.x) do not check the underlying
file or directory ACL when opening an alternate data stream.

According to the SMB1 and SMB2+ protocols the ACL on an underlying
file or directory should control what access is allowed to alternate
data streams that are associated with the file or directory.

By default no version of Samba supports alternate data streams
on files or directories.

Samba can be configured to support alternate data streams by loading
either one of two virtual file system modues (VFS) vfs_streams_depot or
vfs_streams_xattr supplied with Samba, so this bug only affects Samba
servers configured this way.

To determine if your server is vulnerable, check for the strings
"streams_depot" or "streams_xattr" inside your smb.conf configuration

o CVE-2013-4476:
In setups which provide ldap(s) and/or https services, the private
key for SSL/TLS encryption might be world readable. This typically
happens in active directory domain controller setups.
Inserisci un commento sul forum Commenta la News sul Forum


Categoria: Linux

Licenza: Open source

OS: Linux

La Community di

La community con le risposte che cerchi ! Partecipa é gratis !
Iscrizione ForumIscriviti al Forum


Vuoi ricevere tutti gli aggiornamenti di SWZone direttamente via mail ?
Iscrizione NewsletterIscriviti alla Newsletter