Scientific Linux alert SLSA-2014:0305-1 (samba)

From:
    	     
 
Pat Riehecky <riehecky@fnal.gov> 
To:
    	     
 
<scientific-linux-errata@listserv.fnal.gov> 
Subject:
    	     
 
Security ERRATA Moderate: samba on SL5.x i386/x86_64 
Date:
    	     
 
Mon, 17 Mar 2014 18:42:20 +0000
Message-ID:
    	     
 
<20140317184220.14023.654@slpackages.fnal.gov>
Synopsis:          Moderate: samba security update
Advisory ID:       SLSA-2014:0305-1
Issue Date:        2014-03-17
CVE Numbers:       CVE-2013-0213
                   CVE-2013-0214
                   CVE-2013-4124
--

It was discovered that the Samba Web Administration Tool (SWAT) did not
protect against being opened in a web page frame. A remote attacker could
possibly use this flaw to conduct a clickjacking attack against SWAT users
or users with an active SWAT session. (CVE-2013-0213)

A flaw was found in the Cross-Site Request Forgery (CSRF) protection
mechanism implemented in SWAT. An attacker with the knowledge of a
victim's password could use this flaw to bypass CSRF protections and
conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214)

An integer overflow flaw was found in the way Samba handled an Extended
Attribute (EA) list provided by a client. A malicious client could send a
specially crafted EA list that triggered an overflow, causing the server
to loop and reprocess the list using an excessive amount of memory.
(CVE-2013-4124)

Note: This issue did not affect the default configuration of the Samba
server.

After installing this update, the smb service will be restarted
automatically.
--

SL5
  x86_64
    libsmbclient-3.0.33-3.40.el5_10.i386.rpm
    libsmbclient-3.0.33-3.40.el5_10.x86_64.rpm
    samba-3.0.33-3.40.el5_10.x86_64.rpm
    samba-client-3.0.33-3.40.el5_10.x86_64.rpm
    samba-common-3.0.33-3.40.el5_10.i386.rpm
    samba-common-3.0.33-3.40.el5_10.x86_64.rpm
    samba-debuginfo-3.0.33-3.40.el5_10.i386.rpm
    samba-debuginfo-3.0.33-3.40.el5_10.x86_64.rpm
    samba-swat-3.0.33-3.40.el5_10.x86_64.rpm
    libsmbclient-devel-3.0.33-3.40.el5_10.i386.rpm
    libsmbclient-devel-3.0.33-3.40.el5_10.x86_64.rpm
  i386
    libsmbclient-3.0.33-3.40.el5_10.i386.rpm
    samba-3.0.33-3.40.el5_10.i386.rpm
    samba-client-3.0.33-3.40.el5_10.i386.rpm
    samba-common-3.0.33-3.40.el5_10.i386.rpm
    samba-debuginfo-3.0.33-3.40.el5_10.i386.rpm
    samba-swat-3.0.33-3.40.el5_10.i386.rpm
    libsmbclient-devel-3.0.33-3.40.el5_10.i386.rpm

- Scientific Linux Development Team