SAMBA+ 4.10.3, 4.9.8 and 4.8.12 packages have just been released by SerNet. These are important security releases, please update affected systems as soon as possible. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux and Ubuntu.
The packages address the following issues:
- CVE-2018-16860 Samba AD DC S4U2Self/S4U2Proxy unkeyed checksum
The checksum validation in the S4U2Self handler in the embedded Heimdal KDC did not first confirm that the checksum was keyed, allowing replacement of the requested target (client) principal.
Additionally SAMBA+ LTS packages for 4.5, 4.6 and 4.7 have been released, addressing the security defects. Please visit https://samba.plus/lts/ for further information.
SAMBA+ packages and all later versions are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.