There is a security update of Samba: version 4.3.7 and a regression fix
in 4.3.8 [0]. I have updated our package to version 4.3.8 with commit
645deac3264744ec09c027a8b9762fdf62aced70.
This update addresses the following vulnerabilities:
o CVE-2015-5370 (Multiple errors in DCE-RPC code)
o CVE-2016-2110 (Man in the middle attacks possible with NTLMSSP)
o CVE-2016-2111 (NETLOGON Spoofing Vulnerability)
o CVE-2016-2112 (LDAP client and server don't enforce integrity)
o CVE-2016-2113 (Missing TLS certificate validation)
o CVE-2016-2114 ("server signing = mandatory" not enforced)
o CVE-2016-2115 (SMB IPC traffic is not integrity protected)
o CVE-2016-2118 (SAMR and LSA man in the middle attacks possible)
Please update your installations.
[0]
https://www.samba.org/samba/history/samba-4.3.8.html
https://www.samba.org/samba/history/security.html
Leo Famulari (1):
gnu: samba: Update to 4.3.8.
gnu/packages/samba.scm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--
2.7.3
