From security em unicamp.br  Wed Apr  6 09:42:25 2016
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Wed, 6 Apr 2016 09:42:25 -0300
Subject: [SECURITY-L] [RHSA-2016:0601-01] Important: bind security update]
Message-ID: <20160406124225.GC2757@unicamp.br>


=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: bind security update
Advisory ID:       RHSA-2016:0601-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-0601.html
Issue date:        2016-04-06
CVE Names:         CVE-2016-1285 CVE-2016-1286 
=====================================================================

1. Summary:

An update for bind is now available for Red Hat Enterprise Linux 6.2
Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Server AUS (v. 6.2) - x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 6.2) - x86_64

3. Description:

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named); a resolver
library (routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* A denial of service flaw was found in the way BIND parsed signature
records for DNAME records. By sending a specially crafted query, a remote
attacker could use this flaw to cause named to crash. (CVE-2016-1286)

* A denial of service flaw was found in the way BIND processed certain
control channel input. A remote attacker able to send a malformed packet to
the control channel could use this flaw to cause named to crash.
(CVE-2016-1285)

Red Hat would like to thank ISC for reporting these issues.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, the BIND daemon (named) will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1315674 - CVE-2016-1285 bind: malformed packet sent to rndc can trigger assertion failure
1315680 - CVE-2016-1286 bind: malformed signature records for DNAME records can trigger assertion failure

6. Package List:

Red Hat Enterprise Linux Server AUS (v. 6.2):

Source:
bind-9.7.3-8.P3.el6_2.4.src.rpm

x86_64:
bind-9.7.3-8.P3.el6_2.4.x86_64.rpm
bind-chroot-9.7.3-8.P3.el6_2.4.x86_64.rpm
bind-debuginfo-9.7.3-8.P3.el6_2.4.i686.rpm
bind-debuginfo-9.7.3-8.P3.el6_2.4.x86_64.rpm
bind-libs-9.7.3-8.P3.el6_2.4.i686.rpm
bind-libs-9.7.3-8.P3.el6_2.4.x86_64.rpm
bind-utils-9.7.3-8.P3.el6_2.4.x86_64.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 6.2):

Source:
bind-9.7.3-8.P3.el6_2.4.src.rpm

x86_64:
bind-debuginfo-9.7.3-8.P3.el6_2.4.i686.rpm
bind-debuginfo-9.7.3-8.P3.el6_2.4.x86_64.rpm
bind-devel-9.7.3-8.P3.el6_2.4.i686.rpm
bind-devel-9.7.3-8.P3.el6_2.4.x86_64.rpm
bind-sdb-9.7.3-8.P3.el6_2.4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-1285
https://access.redhat.com/security/cve/CVE-2016-1286
https://access.redhat.com/security/updates/classification/#important
https://kb.isc.org/article/AA-01352
https://kb.isc.org/article/AA-01353

8. Contact:

The Red Hat security contact is <secalert em redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.



From security em unicamp.br  Mon Apr 11 10:36:33 2016
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Mon, 11 Apr 2016 10:36:33 -0300
Subject: [SECURITY-L] [jim@apache.org: [ANNOUNCE] Apache HTTP Server 2.4.20
	Released]
Message-ID: <20160411133633.GM30826@unicamp.br>

----- Forwarded message from Jim Jagielski <jim em apache.org> -----

Date: Mon, 11 Apr 2016 09:10:39 -0400
From: Jim Jagielski <jim em apache.org>
To: announce em httpd.apache.org
Subject: [ANNOUNCE] Apache HTTP Server 2.4.20 Released
X-Mailer: Apple Mail (2.3124)

             Apache HTTP Server 2.4.20 Released

The Apache Software Foundation and the Apache HTTP Server Project
are pleased to announce the release of version 2.4.20 of the Apache
HTTP Server ("Apache").  This version of Apache is our latest GA
release of the new generation 2.4.x branch of Apache HTTPD and
represents fifteen years of innovation by the project, and is
recommended over all previous releases. This release of Apache is
principally a feature and bug fix release.

We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.

Note: Apache httpd 2.4.19 was not released.

Apache HTTP Server 2.4.20 is available for download from:

  http://httpd.apache.org/download.cgi

Apache 2.4 offers numerous enhancements, improvements, and performance
boosts over the 2.2 codebase.  For an overview of new features
introduced since 2.4 please see:

  http://httpd.apache.org/docs/trunk/new_features_2_4.html

Please see the CHANGES_2.4 file, linked from the download page, for a
full list of changes. A condensed list, CHANGES_2.4.20 includes only
those changes introduced since the prior 2.4 release.  A summary of all 
of the security vulnerabilities addressed in this and earlier releases 
is available:

  http://httpd.apache.org/security/vulnerabilities_24.html

This release requires the Apache Portable Runtime (APR) version 1.5.x
and APR-Util version 1.5.x. The APR libraries must be upgraded for all
features of httpd to operate correctly.

This release builds on and extends the Apache 2.2 API.  Modules written
for Apache 2.2 will need to be recompiled in order to run with Apache
2.4, and require minimal or no source code changes.

  http://svn.apache.org/repos/asf/httpd/httpd/trunk/VERSIONING

When upgrading or installing this version of Apache, please bear in mind
that if you intend to use Apache with one of the threaded MPMs (other
than the Prefork MPM), you must ensure that any modules you will be
using (and the libraries they depend on) are thread-safe.


----- End forwarded message -----


From security em unicamp.br  Wed Apr 13 09:01:50 2016
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Wed, 13 Apr 2016 09:01:50 -0300
Subject: [SECURITY-L] [bugzilla@redhat.com: [RHSA-2016:0611-01] Critical:
 samba security update]
Message-ID: <20160413120150.GJ18510@unicamp.br>

----- Forwarded message from bugzilla em redhat.com -----

Date: Tue, 12 Apr 2016 20:28:49 +0000
From: bugzilla em redhat.com
To: rhsa-announce em redhat.com, enterprise-watch-list em redhat.com
Subject: [RHSA-2016:0611-01] Critical: samba security update

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: samba security update
Advisory ID:       RHSA-2016:0611-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-0611.html
Issue date:        2016-04-12
CVE Names:         CVE-2015-5370 CVE-2016-2111 CVE-2016-2112 
                   CVE-2016-2115 CVE-2016-2118 
=====================================================================

1. Summary:

An update for samba is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

3. Description:

Samba is an open-source implementation of the Server Message Block (SMB)
protocol and the related Common Internet File System (CIFS) protocol, which
allow PC-compatible machines to share files, printers, and various
information.

Security Fix(es):

* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A
remote, authenticated attacker could use these flaws to cause a denial of
service against the Samba server (high CPU load or a crash) or, possibly,
execute arbitrary code with the permissions of the user running Samba
(root). This flaw could also be used to downgrade a secure DCE/RPC
connection by a man-in-the-middle attacker taking control of an Active
Directory (AD) object and compromising the security of a Samba Active
Directory Domain Controller (DC). (CVE-2015-5370)

Note: While Samba packages as shipped in Red Hat Enterprise Linux do not
support running Samba as an AD DC, this flaw applies to all roles Samba
implements.

* A protocol flaw, publicly referred to as Badlock, was found in the
Security Account Manager Remote Protocol (MS-SAMR) and the Local Security
Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated
DCE/RPC connection that a client initiates against a server could be used
by a man-in-the-middle attacker to impersonate the authenticated user
against the SAMR or LSA service on the server. As a result, the attacker
would be able to get read/write access to the Security Account Manager
database, and use this to reveal all passwords or any other potentially
sensitive information in that database. (CVE-2016-2118)

* It was discovered that Samba configured as a Domain Controller would
establish a secure communication channel with a machine using a spoofed
computer name. A remote attacker able to observe network traffic could use
this flaw to obtain session-related information about the spoofed machine.
(CVE-2016-2111)

* It was found that Samba's LDAP implementation did not enforce integrity
protection for LDAP connections. A man-in-the-middle attacker could use
this flaw to downgrade LDAP connections to use no integrity protection,
allowing them to hijack such connections. (CVE-2016-2112)

* It was found that Samba did not enable integrity protection for IPC
traffic by default. A man-in-the-middle attacker could use this flaw to
view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Red Hat would like to thank the Samba project for reporting these issues.
Upstream acknowledges Jouni Knuutinen (Synopsis) as the original reporter
of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the original reporter
of CVE-2016-2118, CVE-2016-2112, and CVE-2016-2115.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1309987 - CVE-2015-5370 samba: crash in dcesrv_auth_bind_ack due to missing error check
1311902 - CVE-2016-2111 samba: Spoofing vulnerability when domain controller is configured
1311903 - CVE-2016-2112 samba: Missing downgrade detection
1312084 - CVE-2016-2115 samba: Smb signing not required by default when smb client connection is used for ipc usage
1317990 - CVE-2016-2118 samba: SAMR and LSA man in the middle attacks

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
samba-3.6.23-30.el6_7.src.rpm

i386:
libsmbclient-3.6.23-30.el6_7.i686.rpm
samba-client-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-winbind-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm

x86_64:
libsmbclient-3.6.23-30.el6_7.i686.rpm
libsmbclient-3.6.23-30.el6_7.x86_64.rpm
samba-client-3.6.23-30.el6_7.x86_64.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

i386:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
samba-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-doc-3.6.23-30.el6_7.i686.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.i686.rpm
samba-swat-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.i686.rpm

x86_64:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
libsmbclient-devel-3.6.23-30.el6_7.x86_64.rpm
samba-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-doc-3.6.23-30.el6_7.x86_64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.x86_64.rpm
samba-glusterfs-3.6.23-30.el6_7.x86_64.rpm
samba-swat-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
samba-3.6.23-30.el6_7.src.rpm

x86_64:
samba-client-3.6.23-30.el6_7.x86_64.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

x86_64:
libsmbclient-3.6.23-30.el6_7.i686.rpm
libsmbclient-3.6.23-30.el6_7.x86_64.rpm
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
libsmbclient-devel-3.6.23-30.el6_7.x86_64.rpm
samba-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-doc-3.6.23-30.el6_7.x86_64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.x86_64.rpm
samba-glusterfs-3.6.23-30.el6_7.x86_64.rpm
samba-swat-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
samba-3.6.23-30.el6_7.src.rpm

i386:
libsmbclient-3.6.23-30.el6_7.i686.rpm
samba-3.6.23-30.el6_7.i686.rpm
samba-client-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-winbind-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm

ppc64:
libsmbclient-3.6.23-30.el6_7.ppc.rpm
libsmbclient-3.6.23-30.el6_7.ppc64.rpm
samba-3.6.23-30.el6_7.ppc64.rpm
samba-client-3.6.23-30.el6_7.ppc64.rpm
samba-common-3.6.23-30.el6_7.ppc.rpm
samba-common-3.6.23-30.el6_7.ppc64.rpm
samba-debuginfo-3.6.23-30.el6_7.ppc.rpm
samba-debuginfo-3.6.23-30.el6_7.ppc64.rpm
samba-winbind-3.6.23-30.el6_7.ppc64.rpm
samba-winbind-clients-3.6.23-30.el6_7.ppc.rpm
samba-winbind-clients-3.6.23-30.el6_7.ppc64.rpm

s390x:
libsmbclient-3.6.23-30.el6_7.s390.rpm
libsmbclient-3.6.23-30.el6_7.s390x.rpm
samba-3.6.23-30.el6_7.s390x.rpm
samba-client-3.6.23-30.el6_7.s390x.rpm
samba-common-3.6.23-30.el6_7.s390.rpm
samba-common-3.6.23-30.el6_7.s390x.rpm
samba-debuginfo-3.6.23-30.el6_7.s390.rpm
samba-debuginfo-3.6.23-30.el6_7.s390x.rpm
samba-winbind-3.6.23-30.el6_7.s390x.rpm
samba-winbind-clients-3.6.23-30.el6_7.s390.rpm
samba-winbind-clients-3.6.23-30.el6_7.s390x.rpm

x86_64:
libsmbclient-3.6.23-30.el6_7.i686.rpm
libsmbclient-3.6.23-30.el6_7.x86_64.rpm
samba-3.6.23-30.el6_7.x86_64.rpm
samba-client-3.6.23-30.el6_7.x86_64.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

i386:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-doc-3.6.23-30.el6_7.i686.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.i686.rpm
samba-swat-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.i686.rpm

ppc64:
libsmbclient-devel-3.6.23-30.el6_7.ppc.rpm
libsmbclient-devel-3.6.23-30.el6_7.ppc64.rpm
samba-debuginfo-3.6.23-30.el6_7.ppc.rpm
samba-debuginfo-3.6.23-30.el6_7.ppc64.rpm
samba-doc-3.6.23-30.el6_7.ppc64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.ppc64.rpm
samba-swat-3.6.23-30.el6_7.ppc64.rpm
samba-winbind-devel-3.6.23-30.el6_7.ppc.rpm
samba-winbind-devel-3.6.23-30.el6_7.ppc64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.ppc64.rpm

s390x:
libsmbclient-devel-3.6.23-30.el6_7.s390.rpm
libsmbclient-devel-3.6.23-30.el6_7.s390x.rpm
samba-debuginfo-3.6.23-30.el6_7.s390.rpm
samba-debuginfo-3.6.23-30.el6_7.s390x.rpm
samba-doc-3.6.23-30.el6_7.s390x.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.s390x.rpm
samba-swat-3.6.23-30.el6_7.s390x.rpm
samba-winbind-devel-3.6.23-30.el6_7.s390.rpm
samba-winbind-devel-3.6.23-30.el6_7.s390x.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.s390x.rpm

x86_64:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
libsmbclient-devel-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-doc-3.6.23-30.el6_7.x86_64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.x86_64.rpm
samba-glusterfs-3.6.23-30.el6_7.x86_64.rpm
samba-swat-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
samba-3.6.23-30.el6_7.src.rpm

i386:
libsmbclient-3.6.23-30.el6_7.i686.rpm
samba-3.6.23-30.el6_7.i686.rpm
samba-client-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-winbind-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm

x86_64:
libsmbclient-3.6.23-30.el6_7.i686.rpm
libsmbclient-3.6.23-30.el6_7.x86_64.rpm
samba-3.6.23-30.el6_7.x86_64.rpm
samba-client-3.6.23-30.el6_7.x86_64.rpm
samba-common-3.6.23-30.el6_7.i686.rpm
samba-common-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-clients-3.6.23-30.el6_7.i686.rpm
samba-winbind-clients-3.6.23-30.el6_7.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

i386:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-doc-3.6.23-30.el6_7.i686.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.i686.rpm
samba-swat-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.i686.rpm

x86_64:
libsmbclient-devel-3.6.23-30.el6_7.i686.rpm
libsmbclient-devel-3.6.23-30.el6_7.x86_64.rpm
samba-debuginfo-3.6.23-30.el6_7.i686.rpm
samba-debuginfo-3.6.23-30.el6_7.x86_64.rpm
samba-doc-3.6.23-30.el6_7.x86_64.rpm
samba-domainjoin-gui-3.6.23-30.el6_7.x86_64.rpm
samba-glusterfs-3.6.23-30.el6_7.x86_64.rpm
samba-swat-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-devel-3.6.23-30.el6_7.i686.rpm
samba-winbind-devel-3.6.23-30.el6_7.x86_64.rpm
samba-winbind-krb5-locator-3.6.23-30.el6_7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5370
https://access.redhat.com/security/cve/CVE-2016-2111
https://access.redhat.com/security/cve/CVE-2016-2112
https://access.redhat.com/security/cve/CVE-2016-2115
https://access.redhat.com/security/cve/CVE-2016-2118
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/badlock
https://access.redhat.com/articles/2253041
http://badlock.org/
https://access.redhat.com/articles/2243351

8. Contact:

The Red Hat security contact is <secalert em redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.


--
RHSA-announce mailing list
RHSA-announce em redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

----- End forwarded message -----


From security em unicamp.br  Wed Apr 13 09:02:38 2016
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Wed, 13 Apr 2016 09:02:38 -0300
Subject: [SECURITY-L] [bugzilla@redhat.com: [RHSA-2016:0613-01] Critical:
 samba3x security update]
Message-ID: <20160413120238.GL18510@unicamp.br>

----- Forwarded message from bugzilla em redhat.com -----

Date: Tue, 12 Apr 2016 20:29:29 +0000
From: bugzilla em redhat.com
To: rhsa-announce em redhat.com, enterprise-watch-list em redhat.com
Subject: [RHSA-2016:0613-01] Critical: samba3x security update

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: samba3x security update
Advisory ID:       RHSA-2016:0613-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-0613.html
Issue date:        2016-04-12
CVE Names:         CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 
                   CVE-2016-2112 CVE-2016-2115 CVE-2016-2118 
=====================================================================

1. Summary:

An update for samba3x is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) - i386, x86_64

3. Description:

Samba is an open-source implementation of the Server Message Block (SMB) or
Common Internet File System (CIFS) protocol, which allows PC-compatible
machines to share files, printers, and other information.

Security Fix(es):

* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A
remote, authenticated attacker could use these flaws to cause a denial of
service against the Samba server (high CPU load or a crash) or, possibly,
execute arbitrary code with the permissions of the user running Samba
(root). This flaw could also be used to downgrade a secure DCE/RPC
connection by a man-in-the-middle attacker taking control of an Active
Directory (AD) object and compromising the security of a Samba Active
Directory Domain Controller (DC). (CVE-2015-5370)

Note: While Samba packages as shipped in Red Hat Enterprise Linux do not
support running Samba as an AD DC, this flaw applies to all roles Samba
implements.

* A protocol flaw, publicly referred to as Badlock, was found in the
Security Account Manager Remote Protocol (MS-SAMR) and the Local Security
Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated
DCE/RPC connection that a client initiates against a server could be used
by a man-in-the-middle attacker to impersonate the authenticated user
against the SAMR or LSA service on the server. As a result, the attacker
would be able to get read/write access to the Security Account Manager
database, and use this to reveal all passwords or any other potentially
sensitive information in that database. (CVE-2016-2118)

* Several flaws were found in Samba's implementation of NTLMSSP 
authentication. An unauthenticated, man-in-the-middle attacker could use
this flaw to clear the encryption and integrity flags of a connection,
causing data to be transmitted in plain text. The attacker could also force
the client or server into sending data in plain text even if encryption was
explicitly requested for that connection. (CVE-2016-2110)

* It was discovered that Samba configured as a Domain Controller would
establish a secure communication channel with a machine using a spoofed
computer name. A remote attacker able to observe network traffic could use
this flaw to obtain session-related information about the spoofed machine.
(CVE-2016-2111)

* It was found that Samba's LDAP implementation did not enforce integrity
protection for LDAP connections. A man-in-the-middle attacker could use
this flaw to downgrade LDAP connections to use no integrity protection,
allowing them to hijack such connections. (CVE-2016-2112)

* It was found that Samba did not enable integrity protection for IPC
traffic by default. A man-in-the-middle attacker could use this flaw to
view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Red Hat would like to thank the Samba project for reporting these issues.
Upstream acknowledges Jouni Knuutinen (Synopsis) as the original reporter
of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the original reporter
of CVE-2016-2118, CVE-2016-2110, CVE-2016-2112, and CVE-2016-2115.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1309987 - CVE-2015-5370 samba: crash in dcesrv_auth_bind_ack due to missing error check
1311893 - CVE-2016-2110 samba: Man-in-the-middle attacks possible with NTLMSSP authentication
1311902 - CVE-2016-2111 samba: Spoofing vulnerability when domain controller is configured
1311903 - CVE-2016-2112 samba: Missing downgrade detection
1312084 - CVE-2016-2115 samba: Smb signing not required by default when smb client connection is used for ipc usage
1317990 - CVE-2016-2118 samba: SAMR and LSA man in the middle attacks

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
samba3x-3.6.23-12.el5_11.src.rpm

i386:
samba3x-3.6.23-12.el5_11.i386.rpm
samba3x-client-3.6.23-12.el5_11.i386.rpm
samba3x-common-3.6.23-12.el5_11.i386.rpm
samba3x-debuginfo-3.6.23-12.el5_11.i386.rpm
samba3x-doc-3.6.23-12.el5_11.i386.rpm
samba3x-domainjoin-gui-3.6.23-12.el5_11.i386.rpm
samba3x-swat-3.6.23-12.el5_11.i386.rpm
samba3x-winbind-3.6.23-12.el5_11.i386.rpm

x86_64:
samba3x-3.6.23-12.el5_11.x86_64.rpm
samba3x-client-3.6.23-12.el5_11.x86_64.rpm
samba3x-common-3.6.23-12.el5_11.x86_64.rpm
samba3x-debuginfo-3.6.23-12.el5_11.i386.rpm
samba3x-debuginfo-3.6.23-12.el5_11.x86_64.rpm
samba3x-doc-3.6.23-12.el5_11.x86_64.rpm
samba3x-domainjoin-gui-3.6.23-12.el5_11.x86_64.rpm
samba3x-swat-3.6.23-12.el5_11.x86_64.rpm
samba3x-winbind-3.6.23-12.el5_11.i386.rpm
samba3x-winbind-3.6.23-12.el5_11.x86_64.rpm

Red Hat Enterprise Linux Desktop Workstation (v. 5 client):

Source:
samba3x-3.6.23-12.el5_11.src.rpm

i386:
samba3x-debuginfo-3.6.23-12.el5_11.i386.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.i386.rpm

x86_64:
samba3x-debuginfo-3.6.23-12.el5_11.i386.rpm
samba3x-debuginfo-3.6.23-12.el5_11.x86_64.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.i386.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
samba3x-3.6.23-12.el5_11.src.rpm

i386:
samba3x-3.6.23-12.el5_11.i386.rpm
samba3x-client-3.6.23-12.el5_11.i386.rpm
samba3x-common-3.6.23-12.el5_11.i386.rpm
samba3x-debuginfo-3.6.23-12.el5_11.i386.rpm
samba3x-doc-3.6.23-12.el5_11.i386.rpm
samba3x-domainjoin-gui-3.6.23-12.el5_11.i386.rpm
samba3x-swat-3.6.23-12.el5_11.i386.rpm
samba3x-winbind-3.6.23-12.el5_11.i386.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.i386.rpm

ia64:
samba3x-3.6.23-12.el5_11.ia64.rpm
samba3x-client-3.6.23-12.el5_11.ia64.rpm
samba3x-common-3.6.23-12.el5_11.ia64.rpm
samba3x-debuginfo-3.6.23-12.el5_11.ia64.rpm
samba3x-doc-3.6.23-12.el5_11.ia64.rpm
samba3x-domainjoin-gui-3.6.23-12.el5_11.ia64.rpm
samba3x-swat-3.6.23-12.el5_11.ia64.rpm
samba3x-winbind-3.6.23-12.el5_11.ia64.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.ia64.rpm

ppc:
samba3x-3.6.23-12.el5_11.ppc.rpm
samba3x-client-3.6.23-12.el5_11.ppc.rpm
samba3x-common-3.6.23-12.el5_11.ppc.rpm
samba3x-debuginfo-3.6.23-12.el5_11.ppc.rpm
samba3x-debuginfo-3.6.23-12.el5_11.ppc64.rpm
samba3x-doc-3.6.23-12.el5_11.ppc.rpm
samba3x-domainjoin-gui-3.6.23-12.el5_11.ppc.rpm
samba3x-swat-3.6.23-12.el5_11.ppc.rpm
samba3x-winbind-3.6.23-12.el5_11.ppc.rpm
samba3x-winbind-3.6.23-12.el5_11.ppc64.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.ppc.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.ppc64.rpm

s390x:
samba3x-3.6.23-12.el5_11.s390x.rpm
samba3x-client-3.6.23-12.el5_11.s390x.rpm
samba3x-common-3.6.23-12.el5_11.s390x.rpm
samba3x-debuginfo-3.6.23-12.el5_11.s390.rpm
samba3x-debuginfo-3.6.23-12.el5_11.s390x.rpm
samba3x-doc-3.6.23-12.el5_11.s390x.rpm
samba3x-domainjoin-gui-3.6.23-12.el5_11.s390x.rpm
samba3x-swat-3.6.23-12.el5_11.s390x.rpm
samba3x-winbind-3.6.23-12.el5_11.s390.rpm
samba3x-winbind-3.6.23-12.el5_11.s390x.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.s390.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.s390x.rpm

x86_64:
samba3x-3.6.23-12.el5_11.x86_64.rpm
samba3x-client-3.6.23-12.el5_11.x86_64.rpm
samba3x-common-3.6.23-12.el5_11.x86_64.rpm
samba3x-debuginfo-3.6.23-12.el5_11.i386.rpm
samba3x-debuginfo-3.6.23-12.el5_11.x86_64.rpm
samba3x-doc-3.6.23-12.el5_11.x86_64.rpm
samba3x-domainjoin-gui-3.6.23-12.el5_11.x86_64.rpm
samba3x-swat-3.6.23-12.el5_11.x86_64.rpm
samba3x-winbind-3.6.23-12.el5_11.i386.rpm
samba3x-winbind-3.6.23-12.el5_11.x86_64.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.i386.rpm
samba3x-winbind-devel-3.6.23-12.el5_11.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5370
https://access.redhat.com/security/cve/CVE-2016-2110
https://access.redhat.com/security/cve/CVE-2016-2111
https://access.redhat.com/security/cve/CVE-2016-2112
https://access.redhat.com/security/cve/CVE-2016-2115
https://access.redhat.com/security/cve/CVE-2016-2118
https://access.redhat.com/security/updates/classification/#critical
https://access.redhat.com/security/vulnerabilities/badlock
https://access.redhat.com/articles/2253041
http://badlock.org/
https://access.redhat.com/articles/2243351

8. Contact:

The Red Hat security contact is <secalert em redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.


--
RHSA-announce mailing list
RHSA-announce em redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

----- End forwarded message -----


From security em unicamp.br  Wed Apr 13 09:36:53 2016
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Wed, 13 Apr 2016 09:36:53 -0300
Subject: [SECURITY-L] [bugzilla@redhat.com: [RHSA-2016:0620-01] Critical:
 samba4 security, bug fix, and enhancement update]
Message-ID: <20160413123653.GP18510@unicamp.br>

----- Forwarded message from bugzilla em redhat.com -----

Date: Tue, 12 Apr 2016 17:41:11 -0400
From: bugzilla em redhat.com
To: rhsa-announce em redhat.com, enterprise-watch-list em redhat.com
Subject: [RHSA-2016:0620-01] Critical: samba4 security, bug fix, and enhancement update

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: samba4 security, bug fix, and enhancement update
Advisory ID:       RHSA-2016:0620-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-0620.html
Issue date:        2016-04-12
CVE Names:         CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 
                   CVE-2016-2112 CVE-2016-2113 CVE-2016-2114 
                   CVE-2016-2115 CVE-2016-2118 
=====================================================================

1. Summary:

An update for samba4 is now available for Red Hat Enterprise Linux 6.2
Advanced Update Support, Red Hat Enterprise Linux 6.4 Advanced Update
Support, Red Hat Enterprise Linux 6.5 Advanced Update Support, and Red Hat
Enterprise Linux 6.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux HPC Node EUS (v. 6.6) - x86_64
Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.6) - x86_64
Red Hat Enterprise Linux Server AUS (v. 6.2) - x86_64
Red Hat Enterprise Linux Server AUS (v. 6.4) - x86_64
Red Hat Enterprise Linux Server AUS (v. 6.5) - x86_64
Red Hat Enterprise Linux Server EUS (v. 6.6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 6.2) - x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 6.4) - x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 6.5) - x86_64
Red Hat Enterprise Linux Server Optional EUS (v. 6.6) - i386, ppc64, s390x, x86_64

3. Description:

Samba is an open-source implementation of the Server Message Block (SMB) or
Common Internet File System (CIFS) protocol, which allows PC-compatible
machines to share files, printers, and other information.

The following packages have been upgraded to a newer upstream version:
Samba (4.2.10). Refer to the Release Notes listed in the References section
for a complete list of changes.

Security Fix(es):

* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A
remote, authenticated attacker could use these flaws to cause a denial of
service against the Samba server (high CPU load or a crash) or, possibly,
execute arbitrary code with the permissions of the user running Samba
(root). This flaw could also be used to downgrade a secure DCE/RPC
connection by a man-in-the-middle attacker taking control of an Active
Directory (AD) object and compromising the security of a Samba Active
Directory Domain Controller (DC). (CVE-2015-5370)

Note: While Samba packages as shipped in Red Hat Enterprise Linux do not
support running Samba as an AD DC, this flaw applies to all roles Samba
implements.

* A protocol flaw, publicly referred to as Badlock, was found in the
Security Account Manager Remote Protocol (MS-SAMR) and the Local Security
Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated
DCE/RPC connection that a client initiates against a server could be used
by a man-in-the-middle attacker to impersonate the authenticated user
against the SAMR or LSA service on the server. As a result, the attacker
would be able to get read/write access to the Security Account Manager
database, and use this to reveal all passwords or any other potentially
sensitive information in that database. (CVE-2016-2118)

* Several flaws were found in Samba's implementation of NTLMSSP
authentication. An unauthenticated, man-in-the-middle attacker could use
this flaw to clear the encryption and integrity flags of a connection,
causing data to be transmitted in plain text. The attacker could also force
the client or server into sending data in plain text even if encryption was
explicitly requested for that connection. (CVE-2016-2110)

* It was discovered that Samba configured as a Domain Controller would
establish a secure communication channel with a machine using a spoofed
computer name. A remote attacker able to observe network traffic could use
this flaw to obtain session-related information about the spoofed machine.
(CVE-2016-2111)

* It was found that Samba's LDAP implementation did not enforce integrity
protection for LDAP connections. A man-in-the-middle attacker could use
this flaw to downgrade LDAP connections to use no integrity protection,
allowing them to hijack such connections. (CVE-2016-2112)

* It was found that Samba did not validate SSL/TLS certificates in certain
connections. A man-in-the-middle attacker could use this flaw to spoof a
Samba server using a specially crafted SSL/TLS certificate. (CVE-2016-2113)

* It was discovered that Samba did not enforce Server Message Block (SMB)
signing for clients using the SMB1 protocol. A man-in-the-middle attacker
could use this flaw to modify traffic between a client and a server.
(CVE-2016-2114)

* It was found that Samba did not enable integrity protection for IPC
traffic by default. A man-in-the-middle attacker could use this flaw to
view and modify the data sent between a Samba server and a client.
(CVE-2016-2115)

Red Hat would like to thank the Samba project for reporting these issues.
Upstream acknowledges Jouni Knuutinen (Synopsis) as the original reporter
of CVE-2015-5370; and Stefan Metzmacher (SerNet) as the original reporter
of CVE-2016-2118, CVE-2016-2110, CVE-2016-2112, CVE-2016-2113,
CVE-2016-2114, and CVE-2016-2115.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1309987 - CVE-2015-5370 samba: crash in dcesrv_auth_bind_ack due to missing error check
1311893 - CVE-2016-2110 samba: Man-in-the-middle attacks possible with NTLMSSP authentication
1311902 - CVE-2016-2111 samba: Spoofing vulnerability when domain controller is configured
1311903 - CVE-2016-2112 samba: Missing downgrade detection
1311910 - CVE-2016-2113 samba: Server certificates not validated at client side
1312082 - CVE-2016-2114 samba: Samba based active directory domain controller does not enforce smb signing
1312084 - CVE-2016-2115 samba: Smb signing not required by default when smb client connection is used for ipc usage
1317990 - CVE-2016-2118 samba: SAMR and LSA man in the middle attacks

6. Package List:

Red Hat Enterprise Linux HPC Node EUS (v. 6.6):

Source:
ipa-3.0.0-42.el6_6.1.src.rpm
libldb-1.1.25-2.el6_6.src.rpm
samba4-4.2.10-6.el6_6.src.rpm

x86_64:
ipa-client-3.0.0-42.el6_6.1.x86_64.rpm
ipa-debuginfo-3.0.0-42.el6_6.1.x86_64.rpm
ipa-python-3.0.0-42.el6_6.1.x86_64.rpm
libldb-1.1.25-2.el6_6.i686.rpm
libldb-1.1.25-2.el6_6.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_6.i686.rpm
libldb-debuginfo-1.1.25-2.el6_6.x86_64.rpm
libldb-devel-1.1.25-2.el6_6.i686.rpm
libldb-devel-1.1.25-2.el6_6.x86_64.rpm
pyldb-1.1.25-2.el6_6.x86_64.rpm
samba4-4.2.10-6.el6_6.x86_64.rpm
samba4-client-4.2.10-6.el6_6.x86_64.rpm
samba4-common-4.2.10-6.el6_6.x86_64.rpm
samba4-dc-4.2.10-6.el6_6.x86_64.rpm
samba4-dc-libs-4.2.10-6.el6_6.x86_64.rpm
samba4-debuginfo-4.2.10-6.el6_6.x86_64.rpm
samba4-devel-4.2.10-6.el6_6.x86_64.rpm
samba4-libs-4.2.10-6.el6_6.x86_64.rpm
samba4-pidl-4.2.10-6.el6_6.x86_64.rpm
samba4-python-4.2.10-6.el6_6.x86_64.rpm
samba4-test-4.2.10-6.el6_6.x86_64.rpm
samba4-winbind-4.2.10-6.el6_6.x86_64.rpm
samba4-winbind-clients-4.2.10-6.el6_6.x86_64.rpm
samba4-winbind-krb5-locator-4.2.10-6.el6_6.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.6):

x86_64:
ipa-admintools-3.0.0-42.el6_6.1.x86_64.rpm
ipa-debuginfo-3.0.0-42.el6_6.1.x86_64.rpm
ipa-server-3.0.0-42.el6_6.1.x86_64.rpm
ipa-server-selinux-3.0.0-42.el6_6.1.x86_64.rpm
ipa-server-trust-ad-3.0.0-42.el6_6.1.x86_64.rpm
ldb-tools-1.1.25-2.el6_6.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_6.x86_64.rpm
pyldb-devel-1.1.25-2.el6_6.x86_64.rpm

Red Hat Enterprise Linux Server AUS (v. 6.2):

Source:
libldb-1.1.25-2.el6_2.src.rpm
sssd-1.5.1-66.el6_2.5.src.rpm

x86_64:
libipa_hbac-1.5.1-66.el6_2.5.i686.rpm
libipa_hbac-1.5.1-66.el6_2.5.x86_64.rpm
libipa_hbac-python-1.5.1-66.el6_2.5.x86_64.rpm
libldb-1.1.25-2.el6_2.i686.rpm
libldb-1.1.25-2.el6_2.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_2.i686.rpm
libldb-debuginfo-1.1.25-2.el6_2.x86_64.rpm
libldb-devel-1.1.25-2.el6_2.i686.rpm
libldb-devel-1.1.25-2.el6_2.x86_64.rpm
pyldb-1.1.25-2.el6_2.x86_64.rpm
sssd-1.5.1-66.el6_2.5.x86_64.rpm
sssd-client-1.5.1-66.el6_2.5.i686.rpm
sssd-client-1.5.1-66.el6_2.5.x86_64.rpm
sssd-debuginfo-1.5.1-66.el6_2.5.i686.rpm
sssd-debuginfo-1.5.1-66.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux Server AUS (v. 6.4):

Source:
ipa-3.0.0-26.el6_4.5.src.rpm
libldb-1.1.25-2.el6_4.src.rpm
samba4-4.2.10-6.el6_4.src.rpm
sssd-1.9.2-82.12.el6_4.src.rpm

x86_64:
ipa-admintools-3.0.0-26.el6_4.5.x86_64.rpm
ipa-client-3.0.0-26.el6_4.5.x86_64.rpm
ipa-debuginfo-3.0.0-26.el6_4.5.x86_64.rpm
ipa-python-3.0.0-26.el6_4.5.x86_64.rpm
ipa-server-3.0.0-26.el6_4.5.x86_64.rpm
ipa-server-selinux-3.0.0-26.el6_4.5.x86_64.rpm
ipa-server-trust-ad-3.0.0-26.el6_4.5.x86_64.rpm
libipa_hbac-1.9.2-82.12.el6_4.i686.rpm
libipa_hbac-1.9.2-82.12.el6_4.x86_64.rpm
libipa_hbac-python-1.9.2-82.12.el6_4.x86_64.rpm
libldb-1.1.25-2.el6_4.i686.rpm
libldb-1.1.25-2.el6_4.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_4.i686.rpm
libldb-debuginfo-1.1.25-2.el6_4.x86_64.rpm
libldb-devel-1.1.25-2.el6_4.i686.rpm
libldb-devel-1.1.25-2.el6_4.x86_64.rpm
libsss_autofs-1.9.2-82.12.el6_4.x86_64.rpm
libsss_idmap-1.9.2-82.12.el6_4.i686.rpm
libsss_idmap-1.9.2-82.12.el6_4.x86_64.rpm
libsss_sudo-1.9.2-82.12.el6_4.x86_64.rpm
pyldb-1.1.25-2.el6_4.x86_64.rpm
samba4-4.2.10-6.el6_4.x86_64.rpm
samba4-client-4.2.10-6.el6_4.x86_64.rpm
samba4-common-4.2.10-6.el6_4.x86_64.rpm
samba4-dc-4.2.10-6.el6_4.x86_64.rpm
samba4-dc-libs-4.2.10-6.el6_4.x86_64.rpm
samba4-debuginfo-4.2.10-6.el6_4.x86_64.rpm
samba4-devel-4.2.10-6.el6_4.x86_64.rpm
samba4-libs-4.2.10-6.el6_4.x86_64.rpm
samba4-pidl-4.2.10-6.el6_4.x86_64.rpm
samba4-python-4.2.10-6.el6_4.x86_64.rpm
samba4-test-4.2.10-6.el6_4.x86_64.rpm
samba4-winbind-4.2.10-6.el6_4.x86_64.rpm
samba4-winbind-clients-4.2.10-6.el6_4.x86_64.rpm
samba4-winbind-krb5-locator-4.2.10-6.el6_4.x86_64.rpm
sssd-1.9.2-82.12.el6_4.x86_64.rpm
sssd-client-1.9.2-82.12.el6_4.i686.rpm
sssd-client-1.9.2-82.12.el6_4.x86_64.rpm
sssd-debuginfo-1.9.2-82.12.el6_4.i686.rpm
sssd-debuginfo-1.9.2-82.12.el6_4.x86_64.rpm

Red Hat Enterprise Linux Server AUS (v. 6.5):

Source:
ipa-3.0.0-37.el6_5.1.src.rpm
libldb-1.1.25-2.el6_5.src.rpm
samba4-4.2.10-6.el6_5.src.rpm
sssd-1.9.2-129.el6_5.7.src.rpm

x86_64:
ipa-admintools-3.0.0-37.el6_5.1.x86_64.rpm
ipa-client-3.0.0-37.el6_5.1.x86_64.rpm
ipa-debuginfo-3.0.0-37.el6_5.1.x86_64.rpm
ipa-python-3.0.0-37.el6_5.1.x86_64.rpm
ipa-server-3.0.0-37.el6_5.1.x86_64.rpm
ipa-server-selinux-3.0.0-37.el6_5.1.x86_64.rpm
ipa-server-trust-ad-3.0.0-37.el6_5.1.x86_64.rpm
libipa_hbac-1.9.2-129.el6_5.7.i686.rpm
libipa_hbac-1.9.2-129.el6_5.7.x86_64.rpm
libipa_hbac-python-1.9.2-129.el6_5.7.x86_64.rpm
libldb-1.1.25-2.el6_5.i686.rpm
libldb-1.1.25-2.el6_5.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_5.i686.rpm
libldb-debuginfo-1.1.25-2.el6_5.x86_64.rpm
libldb-devel-1.1.25-2.el6_5.i686.rpm
libldb-devel-1.1.25-2.el6_5.x86_64.rpm
libsss_autofs-1.9.2-129.el6_5.7.x86_64.rpm
libsss_idmap-1.9.2-129.el6_5.7.i686.rpm
libsss_idmap-1.9.2-129.el6_5.7.x86_64.rpm
libsss_sudo-1.9.2-129.el6_5.7.x86_64.rpm
pyldb-1.1.25-2.el6_5.x86_64.rpm
samba4-4.2.10-6.el6_5.x86_64.rpm
samba4-client-4.2.10-6.el6_5.x86_64.rpm
samba4-common-4.2.10-6.el6_5.x86_64.rpm
samba4-dc-4.2.10-6.el6_5.x86_64.rpm
samba4-dc-libs-4.2.10-6.el6_5.x86_64.rpm
samba4-debuginfo-4.2.10-6.el6_5.x86_64.rpm
samba4-devel-4.2.10-6.el6_5.x86_64.rpm
samba4-libs-4.2.10-6.el6_5.x86_64.rpm
samba4-pidl-4.2.10-6.el6_5.x86_64.rpm
samba4-python-4.2.10-6.el6_5.x86_64.rpm
samba4-test-4.2.10-6.el6_5.x86_64.rpm
samba4-winbind-4.2.10-6.el6_5.x86_64.rpm
samba4-winbind-clients-4.2.10-6.el6_5.x86_64.rpm
samba4-winbind-krb5-locator-4.2.10-6.el6_5.x86_64.rpm
sssd-1.9.2-129.el6_5.7.x86_64.rpm
sssd-client-1.9.2-129.el6_5.7.i686.rpm
sssd-client-1.9.2-129.el6_5.7.x86_64.rpm
sssd-debuginfo-1.9.2-129.el6_5.7.i686.rpm
sssd-debuginfo-1.9.2-129.el6_5.7.x86_64.rpm

Red Hat Enterprise Linux Server EUS (v. 6.6):

Source:
ipa-3.0.0-42.el6_6.1.src.rpm
libldb-1.1.25-2.el6_6.src.rpm
samba4-4.2.10-6.el6_6.src.rpm

i386:
ipa-admintools-3.0.0-42.el6_6.1.i686.rpm
ipa-client-3.0.0-42.el6_6.1.i686.rpm
ipa-debuginfo-3.0.0-42.el6_6.1.i686.rpm
ipa-python-3.0.0-42.el6_6.1.i686.rpm
ipa-server-3.0.0-42.el6_6.1.i686.rpm
ipa-server-selinux-3.0.0-42.el6_6.1.i686.rpm
ipa-server-trust-ad-3.0.0-42.el6_6.1.i686.rpm
libldb-1.1.25-2.el6_6.i686.rpm
libldb-debuginfo-1.1.25-2.el6_6.i686.rpm
libldb-devel-1.1.25-2.el6_6.i686.rpm
pyldb-1.1.25-2.el6_6.i686.rpm
samba4-4.2.10-6.el6_6.i686.rpm
samba4-client-4.2.10-6.el6_6.i686.rpm
samba4-common-4.2.10-6.el6_6.i686.rpm
samba4-dc-4.2.10-6.el6_6.i686.rpm
samba4-dc-libs-4.2.10-6.el6_6.i686.rpm
samba4-debuginfo-4.2.10-6.el6_6.i686.rpm
samba4-devel-4.2.10-6.el6_6.i686.rpm
samba4-libs-4.2.10-6.el6_6.i686.rpm
samba4-pidl-4.2.10-6.el6_6.i686.rpm
samba4-python-4.2.10-6.el6_6.i686.rpm
samba4-test-4.2.10-6.el6_6.i686.rpm
samba4-winbind-4.2.10-6.el6_6.i686.rpm
samba4-winbind-clients-4.2.10-6.el6_6.i686.rpm
samba4-winbind-krb5-locator-4.2.10-6.el6_6.i686.rpm

ppc64:
ipa-admintools-3.0.0-42.el6_6.1.ppc64.rpm
ipa-client-3.0.0-42.el6_6.1.ppc64.rpm
ipa-debuginfo-3.0.0-42.el6_6.1.ppc64.rpm
ipa-python-3.0.0-42.el6_6.1.ppc64.rpm
libldb-1.1.25-2.el6_6.ppc.rpm
libldb-1.1.25-2.el6_6.ppc64.rpm
libldb-debuginfo-1.1.25-2.el6_6.ppc.rpm
libldb-debuginfo-1.1.25-2.el6_6.ppc64.rpm
libldb-devel-1.1.25-2.el6_6.ppc.rpm
libldb-devel-1.1.25-2.el6_6.ppc64.rpm
pyldb-1.1.25-2.el6_6.ppc64.rpm
samba4-4.2.10-6.el6_6.ppc64.rpm
samba4-client-4.2.10-6.el6_6.ppc64.rpm
samba4-common-4.2.10-6.el6_6.ppc64.rpm
samba4-dc-4.2.10-6.el6_6.ppc64.rpm
samba4-dc-libs-4.2.10-6.el6_6.ppc64.rpm
samba4-debuginfo-4.2.10-6.el6_6.ppc64.rpm
samba4-devel-4.2.10-6.el6_6.ppc64.rpm
samba4-libs-4.2.10-6.el6_6.ppc64.rpm
samba4-pidl-4.2.10-6.el6_6.ppc64.rpm
samba4-python-4.2.10-6.el6_6.ppc64.rpm
samba4-test-4.2.10-6.el6_6.ppc64.rpm
samba4-winbind-4.2.10-6.el6_6.ppc64.rpm
samba4-winbind-clients-4.2.10-6.el6_6.ppc64.rpm
samba4-winbind-krb5-locator-4.2.10-6.el6_6.ppc64.rpm

s390x:
ipa-admintools-3.0.0-42.el6_6.1.s390x.rpm
ipa-client-3.0.0-42.el6_6.1.s390x.rpm
ipa-debuginfo-3.0.0-42.el6_6.1.s390x.rpm
ipa-python-3.0.0-42.el6_6.1.s390x.rpm
libldb-1.1.25-2.el6_6.s390.rpm
libldb-1.1.25-2.el6_6.s390x.rpm
libldb-debuginfo-1.1.25-2.el6_6.s390.rpm
libldb-debuginfo-1.1.25-2.el6_6.s390x.rpm
libldb-devel-1.1.25-2.el6_6.s390.rpm
libldb-devel-1.1.25-2.el6_6.s390x.rpm
pyldb-1.1.25-2.el6_6.s390x.rpm
samba4-4.2.10-6.el6_6.s390x.rpm
samba4-client-4.2.10-6.el6_6.s390x.rpm
samba4-common-4.2.10-6.el6_6.s390x.rpm
samba4-dc-4.2.10-6.el6_6.s390x.rpm
samba4-dc-libs-4.2.10-6.el6_6.s390x.rpm
samba4-debuginfo-4.2.10-6.el6_6.s390x.rpm
samba4-devel-4.2.10-6.el6_6.s390x.rpm
samba4-libs-4.2.10-6.el6_6.s390x.rpm
samba4-pidl-4.2.10-6.el6_6.s390x.rpm
samba4-python-4.2.10-6.el6_6.s390x.rpm
samba4-test-4.2.10-6.el6_6.s390x.rpm
samba4-winbind-4.2.10-6.el6_6.s390x.rpm
samba4-winbind-clients-4.2.10-6.el6_6.s390x.rpm
samba4-winbind-krb5-locator-4.2.10-6.el6_6.s390x.rpm

x86_64:
ipa-admintools-3.0.0-42.el6_6.1.x86_64.rpm
ipa-client-3.0.0-42.el6_6.1.x86_64.rpm
ipa-debuginfo-3.0.0-42.el6_6.1.x86_64.rpm
ipa-python-3.0.0-42.el6_6.1.x86_64.rpm
ipa-server-3.0.0-42.el6_6.1.x86_64.rpm
ipa-server-selinux-3.0.0-42.el6_6.1.x86_64.rpm
ipa-server-trust-ad-3.0.0-42.el6_6.1.x86_64.rpm
libldb-1.1.25-2.el6_6.i686.rpm
libldb-1.1.25-2.el6_6.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_6.i686.rpm
libldb-debuginfo-1.1.25-2.el6_6.x86_64.rpm
libldb-devel-1.1.25-2.el6_6.i686.rpm
libldb-devel-1.1.25-2.el6_6.x86_64.rpm
pyldb-1.1.25-2.el6_6.x86_64.rpm
samba4-4.2.10-6.el6_6.x86_64.rpm
samba4-client-4.2.10-6.el6_6.x86_64.rpm
samba4-common-4.2.10-6.el6_6.x86_64.rpm
samba4-dc-4.2.10-6.el6_6.x86_64.rpm
samba4-dc-libs-4.2.10-6.el6_6.x86_64.rpm
samba4-debuginfo-4.2.10-6.el6_6.x86_64.rpm
samba4-devel-4.2.10-6.el6_6.x86_64.rpm
samba4-libs-4.2.10-6.el6_6.x86_64.rpm
samba4-pidl-4.2.10-6.el6_6.x86_64.rpm
samba4-python-4.2.10-6.el6_6.x86_64.rpm
samba4-test-4.2.10-6.el6_6.x86_64.rpm
samba4-winbind-4.2.10-6.el6_6.x86_64.rpm
samba4-winbind-clients-4.2.10-6.el6_6.x86_64.rpm
samba4-winbind-krb5-locator-4.2.10-6.el6_6.x86_64.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 6.2):

Source:
evolution-mapi-0.28.3-8.el6_2.src.rpm
libldb-1.1.25-2.el6_2.src.rpm
openchange-1.0-1.el6_2.src.rpm
samba4-4.2.10-6.el6_2.src.rpm
sssd-1.5.1-66.el6_2.5.src.rpm

x86_64:
evolution-mapi-0.28.3-8.el6_2.i686.rpm
evolution-mapi-0.28.3-8.el6_2.x86_64.rpm
evolution-mapi-debuginfo-0.28.3-8.el6_2.i686.rpm
evolution-mapi-debuginfo-0.28.3-8.el6_2.x86_64.rpm
evolution-mapi-devel-0.28.3-8.el6_2.i686.rpm
evolution-mapi-devel-0.28.3-8.el6_2.x86_64.rpm
ldb-tools-1.1.25-2.el6_2.x86_64.rpm
libipa_hbac-devel-1.5.1-66.el6_2.5.i686.rpm
libipa_hbac-devel-1.5.1-66.el6_2.5.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_2.i686.rpm
libldb-debuginfo-1.1.25-2.el6_2.x86_64.rpm
libldb-devel-1.1.25-2.el6_2.i686.rpm
libldb-devel-1.1.25-2.el6_2.x86_64.rpm
openchange-1.0-1.el6_2.i686.rpm
openchange-1.0-1.el6_2.x86_64.rpm
openchange-client-1.0-1.el6_2.x86_64.rpm
openchange-debuginfo-1.0-1.el6_2.i686.rpm
openchange-debuginfo-1.0-1.el6_2.x86_64.rpm
openchange-devel-1.0-1.el6_2.i686.rpm
openchange-devel-1.0-1.el6_2.x86_64.rpm
openchange-devel-docs-1.0-1.el6_2.x86_64.rpm
pyldb-devel-1.1.25-2.el6_2.x86_64.rpm
samba4-4.2.10-6.el6_2.x86_64.rpm
samba4-debuginfo-4.2.10-6.el6_2.i686.rpm
samba4-debuginfo-4.2.10-6.el6_2.x86_64.rpm
samba4-devel-4.2.10-6.el6_2.i686.rpm
samba4-devel-4.2.10-6.el6_2.x86_64.rpm
samba4-libs-4.2.10-6.el6_2.i686.rpm
samba4-libs-4.2.10-6.el6_2.x86_64.rpm
samba4-pidl-4.2.10-6.el6_2.x86_64.rpm
sssd-debuginfo-1.5.1-66.el6_2.5.i686.rpm
sssd-debuginfo-1.5.1-66.el6_2.5.x86_64.rpm
sssd-tools-1.5.1-66.el6_2.5.x86_64.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 6.4):

Source:
libldb-1.1.25-2.el6_4.src.rpm
openchange-1.0-5.el6_4.src.rpm
sssd-1.9.2-82.12.el6_4.src.rpm

x86_64:
ldb-tools-1.1.25-2.el6_4.x86_64.rpm
libipa_hbac-devel-1.9.2-82.12.el6_4.i686.rpm
libipa_hbac-devel-1.9.2-82.12.el6_4.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_4.x86_64.rpm
libsss_idmap-devel-1.9.2-82.12.el6_4.i686.rpm
libsss_idmap-devel-1.9.2-82.12.el6_4.x86_64.rpm
libsss_sudo-devel-1.9.2-82.12.el6_4.i686.rpm
libsss_sudo-devel-1.9.2-82.12.el6_4.x86_64.rpm
openchange-1.0-5.el6_4.x86_64.rpm
openchange-client-1.0-5.el6_4.x86_64.rpm
openchange-debuginfo-1.0-5.el6_4.x86_64.rpm
openchange-devel-1.0-5.el6_4.x86_64.rpm
openchange-devel-docs-1.0-5.el6_4.x86_64.rpm
pyldb-devel-1.1.25-2.el6_4.x86_64.rpm
sssd-debuginfo-1.9.2-82.12.el6_4.i686.rpm
sssd-debuginfo-1.9.2-82.12.el6_4.x86_64.rpm
sssd-tools-1.9.2-82.12.el6_4.x86_64.rpm

Red Hat Enterprise Linux Server Optional AUS (v. 6.5):

Source:
libldb-1.1.25-2.el6_5.src.rpm
openchange-1.0-7.el6_5.src.rpm
sssd-1.9.2-129.el6_5.7.src.rpm

x86_64:
ldb-tools-1.1.25-2.el6_5.x86_64.rpm
libipa_hbac-devel-1.9.2-129.el6_5.7.i686.rpm
libipa_hbac-devel-1.9.2-129.el6_5.7.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_5.x86_64.rpm
libsss_idmap-devel-1.9.2-129.el6_5.7.i686.rpm
libsss_idmap-devel-1.9.2-129.el6_5.7.x86_64.rpm
libsss_sudo-devel-1.9.2-129.el6_5.7.i686.rpm
libsss_sudo-devel-1.9.2-129.el6_5.7.x86_64.rpm
openchange-1.0-7.el6_5.x86_64.rpm
openchange-client-1.0-7.el6_5.x86_64.rpm
openchange-debuginfo-1.0-7.el6_5.x86_64.rpm
openchange-devel-1.0-7.el6_5.x86_64.rpm
openchange-devel-docs-1.0-7.el6_5.x86_64.rpm
pyldb-devel-1.1.25-2.el6_5.x86_64.rpm
sssd-debuginfo-1.9.2-129.el6_5.7.i686.rpm
sssd-debuginfo-1.9.2-129.el6_5.7.x86_64.rpm
sssd-tools-1.9.2-129.el6_5.7.x86_64.rpm

Red Hat Enterprise Linux Server Optional EUS (v. 6.6):

Source:
openchange-1.0-7.el6_6.src.rpm

i386:
ldb-tools-1.1.25-2.el6_6.i686.rpm
libldb-debuginfo-1.1.25-2.el6_6.i686.rpm
openchange-1.0-7.el6_6.i686.rpm
openchange-client-1.0-7.el6_6.i686.rpm
openchange-debuginfo-1.0-7.el6_6.i686.rpm
openchange-devel-1.0-7.el6_6.i686.rpm
openchange-devel-docs-1.0-7.el6_6.i686.rpm
pyldb-devel-1.1.25-2.el6_6.i686.rpm

ppc64:
ldb-tools-1.1.25-2.el6_6.ppc64.rpm
libldb-debuginfo-1.1.25-2.el6_6.ppc64.rpm
openchange-1.0-7.el6_6.ppc64.rpm
openchange-client-1.0-7.el6_6.ppc64.rpm
openchange-debuginfo-1.0-7.el6_6.ppc64.rpm
openchange-devel-1.0-7.el6_6.ppc64.rpm
openchange-devel-docs-1.0-7.el6_6.ppc64.rpm
pyldb-devel-1.1.25-2.el6_6.ppc64.rpm

s390x:
ldb-tools-1.1.25-2.el6_6.s390x.rpm
libldb-debuginfo-1.1.25-2.el6_6.s390x.rpm
openchange-1.0-7.el6_6.s390x.rpm
openchange-client-1.0-7.el6_6.s390x.rpm
openchange-debuginfo-1.0-7.el6_6.s390x.rpm
openchange-devel-1.0-7.el6_6.s390x.rpm
openchange-devel-docs-1.0-7.el6_6.s390x.rpm
pyldb-devel-1.1.25-2.el6_6.s390x.rpm

x86_64:
ldb-tools-1.1.25-2.el6_6.x86_64.rpm
libldb-debuginfo-1.1.25-2.el6_6.x86_64.rpm
openchange-1.0-7.el6_6.x86_64.rpm
openchange-client-1.0-7.el6_6.x86_64.rpm
openchange-debuginfo-1.0-7.el6_6.x86_64.rpm
openchange-devel-1.0-7.el6_6.x86_64.rpm
openchange-devel-docs-1.0-7.el6_6.x86_64.rpm
pyldb-devel-1.1.25-2.el6_6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5370
https://access.redhat.com/security/cve/CVE-2016-2110
https://access.redhat.com/security/cve/CVE-2016-2111
https://access.redhat.com/security/cve/CVE-2016-2112
https://access.redhat.com/security/cve/CVE-2016-2113
https://access.redhat.com/security/cve/CVE-2016-2114
https://access.redhat.com/security/cve/CVE-2016-2115
https://access.redhat.com/security/cve/CVE-2016-2118
https://access.redhat.com/security/updates/classification/#critical
https://www.samba.org/samba/history/samba-4.2.10.html
https://access.redhat.com/security/vulnerabilities/badlock
https://access.redhat.com/articles/2253041
http://badlock.org/
https://access.redhat.com/articles/2243351

8. Contact:

The Red Hat security contact is <secalert em redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.

--
RHSA-announce mailing list
RHSA-announce em redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

----- End forwarded message -----


From security em unicamp.br  Fri Apr 15 17:26:57 2016
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Fri, 15 Apr 2016 17:26:57 -0300
Subject: [SECURITY-L] [jmm@debian.org: [SECURITY] [DSA 3550-1] openssh
	security update]
Message-ID: <20160415202657.GR15591@unicamp.br>

----- Forwarded message from Moritz Muehlenhoff <jmm em debian.org> -----

Date: Fri, 15 Apr 2016 19:09:09 +0200
From: Moritz Muehlenhoff <jmm em debian.org>
To: debian-security-announce em lists.debian.org
Subject: [SECURITY] [DSA 3550-1] openssh security update

-------------------------------------------------------------------------
Debian Security Advisory DSA-3550-1                   security em debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
April 15, 2016                        https://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : openssh
CVE ID         : CVE-2015-8325

Shayan Sadigh discovered a vulnerability in OpenSSH: If PAM support is
enabled and the sshd PAM configuration is configured to read user-
specified environment variables and the "UseLogin" option is enabled, a
local user may escalate her privileges to root.

In Debian "UseLogin" is not enabled by default.

For the oldstable distribution (wheezy), this problem has been fixed
in version 6.0p1-4+deb7u4.

For the stable distribution (jessie), this problem has been fixed in
version 6.7p1-5+deb8u2.

For the unstable distribution (sid), this problem has been fixed in
version 1:7.2p2-3.

We recommend that you upgrade your openssh packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce em lists.debian.org


----- End forwarded message -----


From security em unicamp.br  Tue Apr 19 11:02:33 2016
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Tue, 19 Apr 2016 11:02:33 -0300
Subject: [SECURITY-L] CERT.br: Novo documento com recomendacoes para mitigar
	ataques DDoS
Message-ID: <20160419140233.GA23054@unicamp.br>

----- Forwarded message from "CERT.br" <cert em cert.br> -----

Date: Tue, 19 Apr 2016 10:41:04 -0300
From: "CERT.br" <cert em cert.br>
To: certbr-anuncios em listas.cert.br
Subject: [certbr-anuncios] Novo documento com recomendacoes para mitigar ataques DDoS


Está disponível um novo documento para administradores de redes,
provedores de conectividade, desenvolvedores de aplicações Web e
usuários finais:

   * Recomendações para Melhorar o Cenário de Ataques Distribuídos de
     Negação de Serviço (DDoS)
     http://www.cert.br/docs/whitepapers/ddos/

Este documento tem o objetivo de reunir boas práticas de segurança que
devem ser seguidas pelos diversos setores que formam a Internet para
tentar reduzir os ataques DDoS e minimizar os problemas por eles
causados.

O documento aborda os seguintes assuntos:

   - Quais os principais alvos e motivações dos ataques DDoS;

   - Como os ataques DDoS são realizados;

   - Quais os tipos de ataques DDoS;

   - Como evitar que redes e sistemas sejam abusados para gerar
     ataques DDoS;

   - Como tratar ataques DDoS, incluindo as fases de preparação,
     detecção, análise, mitigação e pós-ataque.

Atenciosamente,
--
CERT.br
<cert em cert.br>
http://www.cert.br/

_______________________________________________


From security em unicamp.br  Wed Apr 20 10:49:13 2016
From: security em unicamp.br (CSIRT - UNICAMP)
Date: Wed, 20 Apr 2016 10:49:13 -0300
Subject: [SECURITY-L] CAIS-Alerta: Resumo dos Boletins de Seguranca da
	Microsoft Abril 2016
Message-ID: <20160420134913.GO16964@unicamp.br>

----- Forwarded message from CAIS/RNP Alerta <rnp-alerta em cais.rnp.br> -----

Date: Tue, 19 Apr 2016 16:05:49 -0300 (BRT)
From: CAIS/RNP Alerta <rnp-alerta em cais.rnp.br>
To: rnp-alerta em cais.rnp.br
Subject: CAIS-Alerta: Resumo dos Boletins de Seguranca da Microsoft Abril 2016

Prezados,

A Microsoft publicou 13 boletins de seguran?a em 12 de abril de 2016 que abordam ao todo 31 vulnerabilidades 
em produtos da empresa. As explora??es destas vulnerabilidades permitem execu??o remota de c?digo, eleva??o 
de privil?gio, desvio de recurso de seguran?a e nega??o de servi?o. At? o momento da publica??o deste alerta
n?o foram divulgados c?digos de explora??o para as vulnerabilidades listadas.

Severidade

Cr?tica
. MS16-037 - Atualiza??o de seguran?a cumulativa para o Internet Explorer
. MS16-038 - Atualiza??o de seguran?a cumulativa do Microsoft Edge
. MS16-039 - Atualiza??o de seguran?a para o Microsoft Graphics Component
. MS16-040 - Atualiza??o de seguran?a para Microsoft XML Core Services
. MS16-042 - Atualiza??o de seguran?a para o Microsoft Office
. MS16-050 - Atualiza??o de seguran?a para o Adobe Flash Player         

Importante

. MS16-041 - Atualiza??o de seguran?a para .NET Framework
. MS16-044 - Atualiza??o de seguran?a para o Windows OLE
. MS16-045 - Atualiza??o de seguran?a para o Windows Hyper-V
. MS16-046 - Atualiza??o de seguran?a para o Logon secund?rio
. MS16-047 - Atualiza??o de seguran?a para SAM e protocolos remotos LSAD
. MS16-048 - Atualiza??o de seguran?a para CSRSS
. MS16-049 - Atualiza??o de seguran?a para o HTTP.sys

Moderada

Nenhum boletim

Baixa

Nenhum boletim

O sistema de classifica??o de severidade das vulnerabilidades adotado pelo CAIS ? o da pr?pria Microsoft. O CAIS 
recomenda que se apliquem as corre??es para vulnerabilidades classificadas como cr?tica e importante. No caso 
de corre??es para vulnerabilidades classificadas como moderadas o CAIS recomenda que ao menos as recomenda??es 
de mitiga??o sejam seguidas.

. Cr?tica - Vulnerabilidades cuja explora??o possa permitir a propaga??o de um worm sem a necessidade de 
intera??o com o usu?rio.
. Importante - Vulnerabilidades cuja explora??o possa resultar no comprometimento de confidencialidade, integridade
ou disponibilidade de dados de usu?rios ou a integridade ou disponibilidade de recursos de processamento.
. Moderada - explora??o ? mitigada significativamente por fatores como configura??o padr?o, auditoria ou dificuldade de explora??o.
. Baixa - uma vulnerabilidade cuja explora??o seja extremamente dif?cil ou cujo impacto seja m?nimo.


Corre??es dispon?veis

Recomenda-se atualizar os sistemas para as vers?es dispon?veis em:
Microsoft Update
https://www.update.microsoft.com/microsoftupdate
Microsoft Download Center
http://www.microsoft.com/en-us/download/default.aspx


Mais informa??es

Resumo do Boletim de Seguran?a da Microsoft de abril de 2016
https://technet.microsoft.com/pt-br/library/security/ms16-Apr
Microsoft TechCenter de Seguran?a
https://technet.microsoft.com/pt-br/security
Microsoft Security Response Center . MSRC
https://technet.microsoft.com/pt-br/security/dn440717
Microsoft Security Research & Defense . MSRD
http://blogs.technet.com/b/srd/
Central de Prote??o e Seguran?a Microsoft
https://www.microsoft.com/pt-br/security/default.aspx


Identificador CVE (http://cve.mitre.org):

CVE-2016-0154,CVE-2016-0159,CVE-2016-0160
CVE-2016-0162,CVE-2016-0164,CVE-2016-0166
CVE-2016-0154,CVE-2016-0155,CVE-2016-0156
CVE-2016-0157,CVE-2016-0158,CVE-2016-0161
CVE-2016-0143,CVE-2016-0145,CVE-2016-0165
CVE-2016-0167,CVE-2016-0147,CVE-2016-0148
CVE-2016-0122,CVE-2016-0127,CVE-2016-0136
CVE-2016-0139,CVE-2016-0153,CVE-2016-0088
CVE-2016-0089,CVE-2016-0090,CVE-2016-0135
CVE-2016-0128,CVE-2016-0151,CVE-2016-0150

O CAIS recomenda que os administradores mantenham seus sistemas e aplicativos sempre atualizados, 

de acordo com as ?ltimas vers?es e corre??es oferecidas pelos fabricantes.
Os alertas do CAIS tamb?m s?o oferecidos no Twitter:
Siga @caisrnp

Atenciosamente,

CAIS/RNP

################################################################
#   CENTRO DE ATENDIMENTO A INCIDENTES DE SEGURANCA (CAIS)     #
#       Rede Nacional de Ensino e Pesquisa (RNP)               #
#                                                              #
# cais em cais.rnp.br       http://www.rnp.br/servicos/seguranca  #
# Tel. 019-37873300      Fax. 019-37873301                     #
# Chave PGP disponivel   http://www.rnp.br/cais/cais-pgp.key   #
################################################################

----- End forwarded message -----