# MA-674.072017: MyCERT Advisory - Samba Releases Security Updates

**Date:** 14 Jul 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-674.072017  
**Advisory ID:** MA-674.072017

---

**1.0 Introduction**
The Samba Team has released security updates that address a vulnerability in all versions of Samba from 3.5.0 onward.
|  |
| --- | --- | --- | Severity | Type | Version | Critical (CVE-2017-11103) | Orpheus' Lyre mutual authentication validation bypass | All versions of Samba from 4.0.0 onwards using embedded Heimdal Kerberos. |
**2.0 Impact**
A remote attacker could exploit this vulnerability to take control of an affected system.
**3.0 Affected Products**
• All versions of Samba from 4.0.0 onwards.
**4.0 Recommendations**
Users and administrators are recommended to review the information in below URL and apply necessary update:
• Security note: <https://www.samba.org/samba/security/CVE-2017-11103.html>
• Patch: <https://www.samba.org/samba/security/>
**Workaround:**
Samba versions built against MIT Kerberos are not impacted.  Unless
you are running Samba as an AD DC, then rebuild samba using:
./configure --with-system-mitkrb5.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#16756f7473642f2f2f56756f74736465737563647f626f387b6f) or [[email protected]](/cdn-cgi/l/email-protection#b7daced4d2c5c3f7daced4d2c5c399d8c5d099dace)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
• <https://www.us-cert.gov/ncas/current-activity/2017/07/12/Samba-Releases-Security-Updates>
• <https://www.samba.org/samba/security/CVE-2017-11103.html>