This update for samba fixes several issues. These security issues were fixed :

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file, leaking information from     the server to the client (bsc#1058624).

  - CVE-2017-12150: Always enforce smb signing when it is     configured (bsc#1058622).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for samba fixes the following issues :

Security issues fixed :

  - CVE-2017-14746: Use-after-free vulnerability     (bsc#1060427).

  - CVE-2017-15275: Server heap memory information leak     (bsc#1063008).

  - CVE-2017-12163: Prevent client short SMB1 write from     writing server memory to file (bsc#1058624).

  - CVE-2017-12151: Keep required encryption across SMB3 dfs     redirects (bsc#1058565).

  - CVE-2017-12150: Some code path don't enforce smb signing     when they should (bsc#1058565).

Bug fixes :

  - Samba was updated to 4.6.9 (bsc#1065066) see release     notes for details.

  - https://www.samba.org/samba/history/samba-4.6.9.html

This update was imported from the SUSE:SLE-12-SP3:Update update project.

Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2304:03 advisory.

    * It was found that samba did not enforce SMB signing when certain configuration options were enabled. A     remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.
    (CVE-2017-12150)
      * An information leak flaw was found in the way SMB1 protocol was implemented by Samba. A malicious     client could use this flaw to dump server memory contents to a file on the samba share or to a shared     printer, though the exact area of server memory cannot be controlled by the attacker. (CVE-2017-12163)     Asianux would like to thank the Samba project for reporting CVE-2017-12150 and     Yihan Lian and Zhibin Hu (Qihoo 360 GearTeam), Stefan Metzmacher (SerNet), and     Jeremy Allison (Google) for reporting CVE-2017-12163. Upstream acknowledges     Stefan Metzmacher (SerNet) as the original reporter of CVE-2017-12150.
    CVE-2017-12150
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2017-12163
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
104529	SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:2971-1)	Nessus	SuSE Local Security Checks	2017/11/13	2025/11/14	high
105218	openSUSE Security Update : samba (openSUSE-2017-1316)	Nessus	SuSE Local Security Checks	2017/12/14	2025/11/12	critical
105999	Fedora 27 : 2:samba (2017-f0c18420e8)	Nessus	Fedora Local Security Checks	2018/1/15	2025/11/4	high
289896	MiracleLinux 4 : samba4-4.2.10-11.AXS4 (AXSA:2017-2304:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high

偵測

搜尋 Plugin

high

critical

high

high