ALT-BU-2020-3788-1
Branch sisyphus update bulletin.
Closed vulnerabilities
BDU:2015-08214
Уязвимости операционной системы Red Hat Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-08216
Уязвимости операционной системы Red Hat Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-08218
Уязвимости операционной системы Red Hat Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2015-08220
Уязвимости операционной системы Red Hat Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-11-21
CVE-2001-1162
Directory traversal vulnerability in the %m macro in the smb.conf configuration file in Samba before 2.2.0a allows remote attackers to overwrite certain files via a .. in a NETBIOS name, which is used as the name for a .log file.
- 20011002-01-P
- 20011002-01-P
- L-105
- L-105
- CLA-2001:405
- CLA-2001:405
- IMNX-2001-70-027-01
- IMNX-2001-70-027-01
- http://us1.samba.org/samba/whatsnew/macroexploit.html
- http://us1.samba.org/samba/whatsnew/macroexploit.html
- CSSA-2001-024.0
- CSSA-2001-024.0
- DSA-065
- DSA-065
- MDKSA-2001-062
- MDKSA-2001-062
- RHSA-2001:086
- RHSA-2001:086
- HPSBUX0107-157
- HPSBUX0107-157
- 20010623 smbd remote file creation vulnerability
- 20010623 smbd remote file creation vulnerability
- 2928
- 2928
- samba-netbios-file-creation(6731)
- samba-netbios-file-creation(6731)
Closed vulnerabilities
BDU:2020-04036
Уязвимость сервера LDAP пакета программ сетевого взаимодействия Samba, настроенного как контроллер домена Active Directory, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-01208
Уязвимость LDAP-сервера samba AD DC, связанная с ошибками при обработке элементов управления «Paged Results» и «ASQ», позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-10700
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A malicious user in a samba AD could use this flaw to cause denial of service. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.
- openSUSE-SU-2020:1023
- openSUSE-SU-2020:1313
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10700
- FEDORA-2020-9cf0b1c8f1
- FEDORA-2020-c931060ab7
- FEDORA-2020-e244c98af5
- GLSA-202007-15
- https://www.samba.org/samba/security/CVE-2020-10700.html
- openSUSE-SU-2020:1023
- https://www.samba.org/samba/security/CVE-2020-10700.html
- GLSA-202007-15
- FEDORA-2020-e244c98af5
- FEDORA-2020-c931060ab7
- FEDORA-2020-9cf0b1c8f1
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10700
- openSUSE-SU-2020:1313
Modified: 2024-11-21
CVE-2020-10704
A flaw was found when using samba as an Active Directory Domain Controller. Due to the way samba handles certain requests as an Active Directory Domain Controller LDAP server, an unauthorized user can cause a stack overflow leading to a denial of service. The highest threat from this vulnerability is to system availability. This issue affects all samba versions before 4.10.15, before 4.11.8 and before 4.12.2.
- openSUSE-SU-2020:1023
- openSUSE-SU-2020:1313
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10704
- [debian-lts-announce] 20201123 [SECURITY] [DLA 2463-1] samba security update
- FEDORA-2020-9cf0b1c8f1
- FEDORA-2020-e244c98af5
- GLSA-202007-15
- https://www.samba.org/samba/security/CVE-2020-10704.html
- openSUSE-SU-2020:1023
- https://www.samba.org/samba/security/CVE-2020-10704.html
- GLSA-202007-15
- FEDORA-2020-e244c98af5
- FEDORA-2020-9cf0b1c8f1
- [debian-lts-announce] 20201123 [SECURITY] [DLA 2463-1] samba security update
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10704
- openSUSE-SU-2020:1313
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-11012
MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
- https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923
- https://github.com/minio/minio/pull/9422
- https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49Z
- https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4w
- https://github.com/minio/minio/commit/4cd6ca02c7957aeb2de3eede08b0754332a77923
- https://github.com/minio/minio/security/advisories/GHSA-xv4r-vccv-mg4w
- https://github.com/minio/minio/releases/tag/RELEASE.2020-04-23T00-58-49Z
- https://github.com/minio/minio/pull/9422