SUSE-SU-2020:2730-1

Sévérité par source

Aucune source ne donne de score CVSS.

Le label propre à Trivy est CRITICAL. Critique selon SUSE.

Description

This update for samba fixes the following issues: - ZeroLogon: An elevation of privilege was possible with some non default configurations when an attacker established a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC) (CVE-2020-1472, bsc#1176579). - Update to samba 4.11.13 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow 'password hash userPassword schemes = CryptSHA256' to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install 'test_util_paths'; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);

Paquets affectés et versions corrigées

Références

• https://bugzilla.suse.com/1176579
• https://lists.suse.com/pipermail/sle-security-updates/2020-September/007469.html
• https://www.suse.com/security/cve/CVE-2020-1472/
• https://www.suse.com/support/security/rating/
• https://www.suse.com/support/update/announcement/2020/suse-su-20202730-1/