lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 20 Jan 2015 19:51:23 -0800 (PST)
From: Slackware Security Team <>
Subject: [slackware-security]  samba (SSA:2015-020-01)

Hash: SHA1

[slackware-security]  samba (SSA:2015-020-01)

New samba packages are available for Slackware 14.1 and -current to
fix a security issue.

Here are the details from the Slackware 14.1 ChangeLog:
patches/packages/samba-4.1.16-i486-1_slack14.1.txz:  Upgraded.
  This update is a security release in order to address CVE-2014-8143
  (Elevation of privilege to Active Directory Domain Controller).
  Samba's AD DC allows the administrator to delegate creation of user or
  computer accounts to specific users or groups.  However, all released
  versions of Samba's AD DC did not implement the additional required
  check on the UF_SERVER_TRUST_ACCOUNT bit in the userAccountControl
  attributes.  Most Samba deployments are not of the AD Domain Controller,
  but are of the classic domain controller, the file server or print server.
  Only the Active Directory Domain Controller is affected by this issue.
  Additionally, most sites running the AD Domain Controller do not configure
  delegation for the creation of user or computer accounts, and so are not
  vulnerable to this issue, as no writes are permitted to the
  userAccountControl attribute, no matter what the value.
  For more information, see:
  (* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
( for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on for
additional mirror sites near you.

Updated package for Slackware 14.1:

Updated package for Slackware x86_64 14.1:

Updated package for Slackware -current:

Updated package for Slackware x86_64 -current:

MD5 signatures:

Slackware 14.1 package:
95e2edc984b8f2e380e653650111798e  samba-4.1.16-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
fbd22bcbe0b8d397ee3b8cb13fd06c56  samba-4.1.16-x86_64-1_slack14.1.txz

Slackware -current package:
b5282dadd66bf4be8bb55ff709c3ea36  n/samba-4.1.16-i486-1.txz

Slackware x86_64 -current package:
47aa64495d8454b93019213caeef156c  n/samba-4.1.16-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
# upgradepkg samba-4.1.16-i486-1_slack14.1.txz

Then, if Samba is running restart it:
# /etc/rc.d/rc.samba restart


Slackware Linux Security Team

| To leave the slackware-security mailing list:                          |
| Send an email to with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
Version: GnuPG v1


Powered by blists - more mailing lists