WHATS NEW IN Samba 2.2.0a: 23rd June 2001
==========================================
SECURITY FIX
============
This is a security bugfix release for Samba 2.2.0. This release provides the
following two changes *ONLY* from the 2.2.0 release.
1). Fix for the security hole discovered by Michal Zalewski (lcamtuf@bos.bindview.com)
and described in the security advisory below.
2). Fix for the hosts allow/hosts deny parameters not being honoured.
No other changes are being made for this release to ensure a security fix only.
For new functionality (including these security fixes) download Samba 2.2.1
when it is available.
The security advisory follows :
IMPORTANT: Security bugfix for Samba
------------------------------------
June 23rd 2001
Summary
-------
A serious security hole has been discovered in all versions of Samba
that allows an attacker to gain root access on the target machine for
certain types of common Samba configuration.
The immediate fix is to edit your smb.conf configuration file and
remove all occurances of the macro "%m". Replacing occurances of %m
with %I is probably the best solution for most sites.
Details
-------
A remote attacker can use a netbios name containing unix path
characters which will then be substituted into the %m macro wherever
it occurs in smb.conf. This can be used to cause Samba to create a log
file on top of an important system file, which in turn can be used to
compromise security on the server.
The most commonly used configuration option that can be vulnerable to
this attack is the "log file" option. The default value for this
option is VARDIR/log.smbd. If the default is used then Samba is not
vulnerable to this attack.
The security hole occurs when a log file option like the following is
used:
log file = /var/log/samba/%m.log
In that case the attacker can use a locally created symbolic link to
overwrite any file on the system. This requires local access to the
server.
If your Samba configuration has something like the following:
log file = /var/log/samba/%m
Then the attacker could successfully compromise your server remotely
as no symbolic link is required. This type of configuration is very
rare.
The most commonly used log file configuration containing %m is the
distributed in the sample configuration file that comes with Samba:
log file = /var/log/samba/log.%m
in that case your machine is not vulnerable to this attack unless you
happen to have a subdirectory in /var/log/samba/ which starts with the
prefix "log."
Credit
------
Thanks to Michal Zalewski (lcamtuf@bos.bindview.com) for finding this
vulnerability.
New Release
-----------
While we recommend that vulnerable sites immediately change their
smb.conf configuration file to prevent the attack we will also be
making new releases of Samba within the next 24 hours to properly fix
the problem. Please see http://www.samba.org/ for the new releases.
Please report any attacks to the appropriate authority.
The Samba Team
security@samba.org
Zebedee Secure Tunnel
=====================
Zebedee is a simple program to establish an encrypted, compressed
"tunnel" for TCP/IP or UDP traffic between two systems. This
allows data from, for example, telnet, ftp and X sessions to be
protected from snooping. You can also use compression, either
with or without data encryption, to gain performance over
low-bandwidth networks.
The main goals for Zebedee are to:
* Provide client and server functionality under both UNIX
and Windows 95/98/NT.
* Be easy to install, use and maintain with little or no
configuration required.
* Have a small footprint, low wire protocol overhead and
give significant traffic reduction by the use of
compression.
* Use only algorithms that are either unpatented or for
which the patent has expired.
* Be entirely free for commercial or non-commercial use and
distributed under the term of the GNU General Public
Licence (see LICENCE.txt for details).
For further information on how to use Zebedee see the file
zebedee.html in the distribution (or the manual page for
zebedee(1) under UNIX -- it is basically the same text). Example
configuration files are also provided.
Nothing fancy, probably needs adjusting to other people's environments.
XXX the list of things that need to be setup in the sandbox should
XXX probably be moved to Packages.txt...
This is pconsole, the parallel console tool. pconsole was meant as an
interactive administrative shell tool for clusters.
pconsole allows you to connect to each node of your cluster simultaneously,
and you can type your administrative commands in a specialized window that
'multiplies' the input to each of the connections you have opened.
pconsole is best run from within X Windows, although it is possible to
employ it without X (in console mode) as well.
You need to install pconsole on only 1 machine in the cluster, this would
usually be your central administrative node.
pconsole makes use of ssh if possible.
-L and rpath specifications in the config files by directly substituting
their final values; this is needed since the configure script directly
manipulates these values via sed and needs the substituted values, not
just ${VAR}. Also honor CXXFLAGS passed in from the environment (possibly
containing optimization flags) during the build.
FOO_REQD=1.0 being converted to foo>=1.0, one can now directly specify
the dependency pattern as FOO_DEPENDS=foo>=1.0. This allows things like
JPEG_DEPENDS=jpeg-6b, or fancier expressions like for postgresql-lib.
Change existing FOO_REQD definitions in Makefiles to FOO_DEPENDS.
Changes:
-remove dead code
-fix bug in example getmailrc file. Thanks to John Gennard for spotting this.
There was an instance of an empty option value left over from before this was
an issue.
by Emmanuel Dreyfus.
fetchmail-5.8.8 (Wed Jun 20 17:22:26 EDT 2001), 20782 lines:
* Fix bug that prevented messages from being marked oversized unless -v was on.
* Byrial Jensen made the tracepoll information RFC822-conformant.
* Reorder code to avoid accessing line buffers after they have been freed.
* Steven Krings's patch to deal with over-long header lines.
* Fix for Debian bug #101500.
* Updated Danish translation by Byrial Jensen.
* Chris Maio's patch for POP3 with BSMTP.
* Patch from HMH resolves DEbian bug #101530.
fetchmail-5.8.7 (Sun Jun 17 12:02:17 EDT 2001), 20749 lines:
* Make fetchmailconf work properly again by fixing tracepolls mismatch.
* HMH's fix for Debian bug #98127.
* driver.c refactoring in preparation for streaming mode.
change is that the automatically generated README.txt file is now
only generated if requested via the -R flag as opposed to always generating
the file.
Suggested by Hubert.
----------------------------------------------------------------------
ChaSen 2.2.7 (2001/06/22)
----------------------------------------------------------------------
- bug fix for sentence end processing
- "EOS" length is modified from 3 to 0.
