USN-4559-1: Samba update
30 September 2020
Several security improvements were added to Samba.
- samba - SMB/CIFS file, print, and login server for Unix
Tom Tervoort discovered that the Netlogon protocol implemented by Samba
incorrectly handled the authentication scheme. A remote attacker could use
this issue to forge an authentication token and steal the credentials of
the domain admin.
While a previous security update fixed the issue by changing the "server
schannel" setting to default to "yes", instead of "auto", which forced a
secure netlogon channel, this update provides additional improvements.
For compatibility reasons with older devices, Samba now allows specifying
an insecure netlogon configuration per machine. See the following link for
In addition, this update adds additional server checks for the protocol
attack in the client-specified challenge to provide some protection when
'server schannel = no/auto' and avoid the false-positive results when
running the proof-of-concept exploit.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.
- USN-4510-1: libpam-winbind, libparse-pidl-perl, samba-common-bin, samba-common, samba, samba-vfs-modules, libwbclient0, libsmbclient, registry-tools, samba-libs, samba-testsuite, smbclient, samba-dev, python-samba, ctdb, winbind, libwbclient-dev, libnss-winbind, samba-dsdb-modules, libsmbclient-dev
- USN-4510-2: libpam-winbind, libparse-pidl-perl, samba-common-bin, samba-common, samba, samba-vfs-modules, libwbclient0, libsmbclient, libpam-smbpass, registry-tools, samba-libs, libsmbsharemodes-dev, samba-testsuite, smbclient, samba-dev, python-samba, samba-doc, winbind, libsmbsharemodes0, libwbclient-dev, libnss-winbind, samba-dsdb-modules, libsmbclient-dev