da0322a097
==============================
Release Notes for Samba 3.5.21
January 30, 2013
==============================
This is a security release in order to address
CVE-2013-0213 (Clickjacking issue in SWAT) and
CVE-2013-0214 (Potential XSRF in SWAT).
o CVE-2013-0213:
All current released versions of Samba are vulnerable to clickjacking in the
Samba Web Administration Tool (SWAT). When the SWAT pages are integrated into
a malicious web page via a frame or iframe and then overlaid by other content,
an attacker could trick an administrator to potentially change Samba settings.
In order to be vulnerable, SWAT must have been installed and enabled
either as a standalone server launched from inetd or xinetd, or as a
CGI plugin to Apache. If SWAT has not been installed or enabled (which
is the default install state for Samba) this advisory can be ignored.
o CVE-2013-0214:
All current released versions of Samba are vulnerable to a cross-site
request forgery in the Samba Web Administration Tool (SWAT). By guessing a
user's password and then tricking a user who is authenticated with SWAT into
clicking a manipulated URL on a different web page, it is possible to manipulate
SWAT.
In order to be vulnerable, the attacker needs to know the victim's password.
Additionally SWAT must have been installed and enabled either as a standalone
server launched from inetd or xinetd, or as a CGI plugin to Apache. If SWAT has
not been installed or enabled (which is the default install state for Samba)
this advisory can be ignored.
Changes since 3.5.20:
---------------------
o Kai Blin <kai@samba.org>
* BUG 9576: CVE-2013-0213: Fix clickjacking issue in SWAT.
* BUG 9577: CVE-2013-0214: Fix potential XSRF in SWAT.
34 lines
1.9 KiB
Text
34 lines
1.9 KiB
Text
$NetBSD: distinfo,v 1.15 2013/01/30 11:41:44 taca Exp $
|
|
|
|
SHA1 (samba-3.5.21.tar.gz) = 4da59c901fe76040201e5a861687580e93a44ddb
|
|
RMD160 (samba-3.5.21.tar.gz) = 6bfa7876f55791bb927d6032987b9c88e658d38e
|
|
Size (samba-3.5.21.tar.gz) = 35377315 bytes
|
|
SHA1 (patch-aa) = 6c8497adce78e8b1dea2a0402d4a980b67b57b8e
|
|
SHA1 (patch-ab) = 0372ff2e3caca866dacd6ed25ae1d02e34a5b567
|
|
SHA1 (patch-ac) = 5b1c0fdb781cb75f81af71ed2695144d4a35e032
|
|
SHA1 (patch-ad) = 447aaf4ea4cc98f0ccd5a3a22e1ffec0e69a3971
|
|
SHA1 (patch-ae) = 6698c698dc64c0f3df159157d182eae6aaa70958
|
|
SHA1 (patch-af) = 247c745717eb6eeadec258b88aa5df9f09d6769c
|
|
SHA1 (patch-ag) = 92fd576c4b05a913051925e461cde9f5a2f2d6bf
|
|
SHA1 (patch-ah) = 6142078efec4263124aa793108c43eef0ce61da4
|
|
SHA1 (patch-ai) = 0a12dcfabcab7986968493d5f06701d06c3d5386
|
|
SHA1 (patch-aj) = aecf98cf53e6bf6890e0fc9a40e6936df5f20a1a
|
|
SHA1 (patch-ak) = cb51a96310eb7dde14351e4f12b68ce8d52c92c3
|
|
SHA1 (patch-al) = f347808c376922da057256d3614a34b556721a66
|
|
SHA1 (patch-am) = 13744f8a5cce3016c37002079eba3c47077e8d6d
|
|
SHA1 (patch-an) = a9b31b791d979a1062006bbe55375aaab69210a1
|
|
SHA1 (patch-ao) = bc31d3003bdaad141652daff2e0b6b3cafcee8c1
|
|
SHA1 (patch-ap) = 3a47d212b1c29a6b3c46b83903c4f011c28a8c3c
|
|
SHA1 (patch-aq) = c3d1a3045364bebaa6c90967837907bd1de0964b
|
|
SHA1 (patch-ar) = 5213b0a3d95d106939c2e268a8538c5e2901079a
|
|
SHA1 (patch-as) = a9fcb1813d55d598bf1226cf004de85701c93e61
|
|
SHA1 (patch-at) = dcfbe79496065559380e5713a758816e538e728b
|
|
SHA1 (patch-au) = f94b27a5792acfa3742b4c07b23b3395b73eba84
|
|
SHA1 (patch-av) = fccde3e48f2b3de3b1adfaa488a67c57696d1a83
|
|
SHA1 (patch-aw) = 36cb31313cdbd1e4670f33924371df5ed3390420
|
|
SHA1 (patch-ba) = 87799a62831b45e6cde8c36fbafbc08596411f98
|
|
SHA1 (patch-bb) = 6283ffa8781d0c069f81e80704a018028e6b2b50
|
|
SHA1 (patch-bc) = 857e2400c8852f3c878f8d82857e80f214be2aea
|
|
SHA1 (patch-bd) = b78324305bbf67fa4a7dd627e0af1618d2bf7b47
|
|
SHA1 (patch-be) = 2b298e596f2f57a595b83619ba68f6ad95febaaa
|
|
SHA1 (patch-bf) = 9511567bfe9b579ae0a1c85483e7fe3ad4866973
|