Updated samba and ntp packages are available for Slackware Linux:
ntp (SSA:2018-229-01)
samba (SSA:2018-229-02)
ntp (SSA:2018-229-01)
samba (SSA:2018-229-02)
ntp (SSA:2018-229-01)
New ntp packages are available for Slackware 14.0, 14.1, 14.2, and -current to
fix security issues.
Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/ntp-4.2.8p12-i586-1_slack14.2.txz: Upgraded.
This release improves on one security fix in ntpd:
LOW/MEDIUM: Sec 3012: Sybil vulnerability: ephemeral association attack
While fixed in ntp-4.2.8p7 and with significant additional protections for
this issue in 4.2.8p11, ntp-4.2.8p12 includes a fix for an edge case in
the new noepeer support. Originally reported by Matt Van Gundy of Cisco.
Edge-case hole reported by Martin Burnicki of Meinberg.
And fixes another security issue in ntpq and ntpdc:
LOW: Sec 3505: The openhost() function used during command-line hostname
processing by ntpq and ntpdc can write beyond its buffer limit, which
could allow an attacker to achieve code execution or escalate to higher
privileges via a long string as the argument for an IPv4 or IPv6
command-line parameter. NOTE: It is unclear whether there are any common
situations in which ntpq or ntpdc is used with a command line from an
untrusted source. Reported by Fakhri Zulkifli.
For more information, see:
http://support.ntp.org/bin/view/Main/SecurityNotice#August_2018_ntp_4_2_8p12_NTP_Rel
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1549
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12327
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/ntp-4.2.8p12-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/ntp-4.2.8p12-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/ntp-4.2.8p12-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/ntp-4.2.8p12-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/ntp-4.2.8p12-i586-1_slack14.2.txz
Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/ntp-4.2.8p12-x86_64-1_slack14.2.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/ntp-4.2.8p12-i586-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/ntp-4.2.8p12-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.0 package:
4a4cc8e4dc6964dc4521058ce776ce4e ntp-4.2.8p12-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
d3a0c36c39e1c0cf5e3b8707f948a180 ntp-4.2.8p12-x86_64-1_slack14.0.txz
Slackware 14.1 package:
7c42e1d9fa476c162be9375a7b662654 ntp-4.2.8p12-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
75472911bb9a76a949c94aa21471f6f0 ntp-4.2.8p12-x86_64-1_slack14.1.txz
Slackware 14.2 package:
2ecd58c0cb1f6d035b36de9098e0d075 ntp-4.2.8p12-i586-1_slack14.2.txz
Slackware x86_64 14.2 package:
96844a4152a8dba26ed73d91662122ce ntp-4.2.8p12-x86_64-1_slack14.2.txz
Slackware -current package:
dc3f52b871f3edc1a64e2d9ef1649591 n/ntp-4.2.8p12-i586-1.txz
Slackware x86_64 -current package:
ecd43289b917c81e682b9b00077c1409 n/ntp-4.2.8p12-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg ntp-4.2.8p12-i586-1_slack14.2.txz
Then, restart the NTP daemon:
# sh /etc/rc.d/rc.ntpd restart
samba (SSA:2018-229-02)
New samba packages are available for Slackware 14.0, 14.1, 14.2, and -current
to fix security issues.
Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/samba-4.6.16-i586-1_slack14.2.txz: Upgraded.
This is a security release in order to address the following defects:
Insufficient input validation on client directory listing in libsmbclient.
A malicious server could return a directory entry that could corrupt
libsmbclient memory.
Confidential attribute disclosure from the AD LDAP server.
Missing access control checks allow discovery of confidential attribute
values via authenticated LDAP search expressions.
For more information, see:
https://www.samba.org/samba/security/CVE-2018-10858.html
https://www.samba.org/samba/security/CVE-2018-10919.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10858
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10919
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/samba-4.6.16-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/samba-4.6.16-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/samba-4.6.16-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/samba-4.6.16-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/samba-4.6.16-i586-1_slack14.2.txz
Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/samba-4.6.16-x86_64-1_slack14.2.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/samba-4.8.4-i586-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/samba-4.8.4-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.0 package:
77145495c7596179c765c11515034dee samba-4.6.16-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
a30325cb28bdc8962baf2ed7d9825490 samba-4.6.16-x86_64-1_slack14.0.txz
Slackware 14.1 package:
a3ecca12612b54c71cf8ac1a2bb345a4 samba-4.6.16-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
ca7abaf3b91a765d14f2932ef2d4bba9 samba-4.6.16-x86_64-1_slack14.1.txz
Slackware 14.2 package:
19ee8695015ead96d142a7f076def5d5 samba-4.6.16-i586-1_slack14.2.txz
Slackware x86_64 14.2 package:
dd0fee60c7b8c21d18f1d9fda5f7963a samba-4.6.16-x86_64-1_slack14.2.txz
Slackware -current package:
843aa03e813d10d25216cb2b0fb2884d n/samba-4.8.4-i586-1.txz
Slackware x86_64 -current package:
d6ec2116d531e3b3e17b3c4b54fa645c n/samba-4.8.4-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg samba-4.6.16-i586-1_slack14.2.txz
Then, if Samba is running restart it:
# /etc/rc.d/rc.samba restart
