NetBSD's libc and Samba both proide SHA2 function with the same
protoype, but with different private context structures. The
Samba version must not override the libc version, otherwise they
are used when using LDAP/SSL, through libldap/libssl/libcrypto
but libcrtypo expect to use the libc flavor.
Without this fix, Samba cannot connect to a LDAP directory that
has a SHA2-signed certificate. This rather cryptic error is raised
in smbd logs:
error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib
==============================
Release Notes for Samba 3.6.25
February 23, 2015
==============================
This is a security release in order to address CVE-2015-0240 (Unexpected
code execution in smbd).
o CVE-2015-0240:
All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an
unexpected code execution vulnerability in the smbd file server
daemon.
A malicious client could send packets that may set up the stack in
such a way that the freeing of memory in a subsequent anonymous
netlogon packet could allow execution of arbitrary code. This code
would execute with root privileges.
o CVE-2014-0178:
In preparing a response to an authenticated FSCTL_GET_SHADOW_COPY_DATA
or FSCTL_SRV_ENUMERATE_SNAPSHOTS client request, affected versions of
Samba do not initialize 8 bytes of the 16 byte SRV_SNAPSHOT_ARRAY
response field. The uninitialized buffer is sent back to the client.
A non-default VFS module providing the get_shadow_copy_data_fn() hook
must be explicitly enabled for Samba to process the aforementioned
client requests. Therefore, only configurations with "shadow_copy" or
"shadow_copy2" specified for the "vfs objects" parameter are vulnerable.
==============================
Release Notes for Samba 3.6.24
June 23, 2014
==============================
This is a security release in order to address
CVE-2014-0244 (Denial of service - CPU loop) and
CVE-2014-3493 (Denial of service - Server crash/memory corruption).
o CVE-2014-0244:
All current released versions of Samba are vulnerable to a denial of
service on the nmbd NetBIOS name services daemon. A malformed packet
can cause the nmbd server to loop the CPU and prevent any further
NetBIOS name service.
This flaw is not exploitable beyond causing the code to loop expending
CPU resources.
o CVE-2014-3493:
All current released versions of Samba are affected by a denial of service
crash involving overwriting memory on an authenticated connection to the
smbd file server.
Do it for all packages that
* mention perl, or
* have a directory name starting with p5-*, or
* depend on a package starting with p5-
like last time, for 5.18, where this didn't lead to complaints.
Let me know if you have any this time.
==============================
Release Notes for Samba 3.6.23
March 11, 2014
==============================
This is a security release in order to address
CVE-2013-4496 (Password lockout not enforced for SAMR password changes).
o CVE-2013-4496:
Samba versions 3.4.0 and above allow the administrator to implement
locking out Samba accounts after a number of bad password attempts.
However, all released versions of Samba did not implement this check for
password changes, such as are available over multiple SAMR and RAP
interfaces, allowing password guessing attacks.
Changes since 3.6.21:
---------------------
o Jeremy Allison <jra@samba.org>
* BUG 10185: CVE-2013-4408: Correctly check DCE-RPC fragment length field.
o Stefan Metzmacher <metze@samba.org>
* BUG 10185: CVE-2013-4408: Correctly check DCE-RPC fragment length field.
o Noel Power <noel.power@suse.com>
* BUGs 10300, 10306: CVE-2012-6150: Fail authentication if user isn't
member of *any* require_membership_of specified groups.
Changes since 3.6.20:
---------------------
o Jeremy Allison <jra@samba.org>
* BUG 10139: Valid utf8 filenames cause "invalid conversion error"
messages.
* BUG 10167: s3-smb2 server: smb2 breaks "smb encryption = mandatory".
* BUG 10187: Missing talloc_free can leak stackframe in error path.
* BUG 10247: xattr: Fix listing EAs on *BSD for non-root users.
o Korobkin <korobkin+samba@gmail.com>
* BUG 10118: Raise debug level for being unable to open a printer.
o Volker Lendecke <vl@samba.org>
* BUG 10195: nsswitch: Fix short writes in winbind_write_sock.
o Arvid Requate <requate@univention.de>
* BUG 10267: Fix Windows 8 printing via local printer drivers.
o Andreas Schneider <asn@cryptomilk.org>
* BUG 10194: Make offline logon cache updating for cross child domain
group membership.
These are security releases in order to address CVE-2013-4475 (ACLs are not checked on opening an alternate data stream on a file or directory) and CVE-2013-4476 (Private key in key.pem world readable).
Changes since 3.6.18:
---------------------
o Jeremy Allison <jra@samba.org>
* BUG 5917: Make Samba work on site with Read Only Domain Controller.
o Christian Ambach <ambi@samba.org>
* BUG 8955: NetrServerPasswordSet2 timeout is too short.
o Günther Deschner <gd@samba.org>
* BUG 9899: Fix fallback to ncacn_np in cm_connect_lsat().
* BUG 9615: Fix fallback to ncacn_np in cm_connect_lsat().
* BUG 10127: Fix 'smbstatus' as non-root user.
o Volker Lendecke <vl@samba.org>
* BUG 8955: Give machine password changes 10 minutes of time.
* BUG 10106: Honour output buffer length set by the client for SMB2 GetInfo
requests.
* BUG 10114: Handle Dropbox (write-only-directory) case correctly in
pathname lookup.
o Karolin Seeger <kseeger@samba.org>
* BUG 10076: Fix variable list in man vfs_crossrename.
o Andreas Schneider <asn@samba.org>
* BUG 9994: s3-winbind: Do not delete an existing valid credential cache.
* BUG 10073: 'net ads join': Fix segmentation fault in
create_local_private_krb5_conf_for_domain.
o Richard Sharpe <realrichardsharpe@gmail.com>
* BUG 10097: MacOSX 10.9 will not follow path-based DFS referrals handed
out by Samba.
==============================
Release Notes for Samba 3.6.17
August 05, 2013
==============================
This is a security release in order to address
CVE-2013-4124 (Missing integer wrap protection in EA list reading can cause
server to loop with DOS).
o CVE-2013-4124:
All current released versions of Samba are vulnerable to a denial of
service on an authenticated or guest connection. A malformed packet
can cause the smbd server to loop the CPU performing memory
allocations and preventing any further service.
A connection to a file share, or a local account is needed to exploit
this problem, either authenticated or unauthenticated if guest
connections are allowed.
This flaw is not exploitable beyond causing the code to loop
allocating memory, which may cause the machine to exceed memory
limits.
Changes since 3.6.16:
---------------------
o Jeremy Allison <jra@samba.org>
* BUG 10010: CVE-2013-4124: Missing integer wrap protection in EA list
reading can cause server to loop with DOS.
are replaced with .include "../../devel/readline/buildlink3.mk", and
USE_GNU_READLINE are removed,
* .include "../../devel/readline/buildlink3.mk" without USE_GNU_READLINE
are replaced with .include "../../mk/readline.buildlink3.mk".
a) refer 'perl' in their Makefile, or
b) have a directory name of p5-*, or
c) have any dependency on any p5-* package
Like last time, where this caused no complaints.
* BUG 9130: Certain xattrs cause Windows error 0x800700FF.
* BUG 9724: Use is_encrypted_packet() function correctly inside server.
* BUG 9733: Fix 'smbcontrol close-share' is not working.
* BUG 9747: Make sure that we only propogate the INHERITED flag when we are
allowed to.
* BUG 9748: Remove unneeded fstat system call from hot read path.
* BUG 9811: Fix bug in old create temp SMB request. Only use VFS functions.
* BUG 9650: New or deleted CUPS printerqueues are not recognized by Samba.
* BUG 9807: wbinfo: Fix segfault in wbinfo_pam_logon.
* BUG 9727: wkssvc: Fix NULL pointer dereference.
* BUG 9736: smbd: Tune "dir" a bit.
* BUG 9775: Fix segfault for "artificial" conn_structs.
* BUG 9809: RHEL SPEC: Package dbwrap_tool man page.
* BUG 9139: Fix the username map optimization.
* BUG 9699: Fix adding case sensitive spn.
* BUG 9723: Add a tool to migrate latin1 printing tdbs to registry.
* BUG 9735: Fix Winbind separator in upn to username conversion.
* BUG 9766: Cache name_to_sid/sid_to_name correctly.
==============================
Release Notes for Samba 3.6.12
January 30, 2013
==============================
This is a security release in order to address
CVE-2013-0213 (Clickjacking issue in SWAT) and
CVE-2013-0214 (Potential XSRF in SWAT).
o CVE-2013-0213:
All current released versions of Samba are vulnerable to clickjacking in the
Samba Web Administration Tool (SWAT). When the SWAT pages are integrated into
a malicious web page via a frame or iframe and then overlaid by other content,
an attacker could trick an administrator to potentially change Samba settings.
In order to be vulnerable, SWAT must have been installed and enabled
either as a standalone server launched from inetd or xinetd, or as a
CGI plugin to Apache. If SWAT has not been installed or enabled (which
is the default install state for Samba) this advisory can be ignored.
o CVE-2013-0214:
All current released versions of Samba are vulnerable to a cross-site
request forgery in the Samba Web Administration Tool (SWAT). By guessing a
user's password and then tricking a user who is authenticated with SWAT into
clicking a manipulated URL on a different web page, it is possible to manipulate
SWAT.
In order to be vulnerable, the attacker needs to know the victim's password.
Additionally SWAT must have been installed and enabled either as a standalone
server launched from inetd or xinetd, or as a CGI plugin to Apache. If SWAT has
not been installed or enabled (which is the default install state for Samba)
this advisory can be ignored.
Changes since 3.6.11:
--------------------
o Kai Blin <kai@samba.org>
* BUG 9576: CVE-2013-0213: Fix clickjacking issue in SWAT.
* BUG 9577: CVE-2013-0214: Fix potential XSRF in SWAT.
