f4f57ff439
==============================
Release Notes for Samba 3.6.17
August 05, 2013
==============================
This is a security release in order to address
CVE-2013-4124 (Missing integer wrap protection in EA list reading can cause
server to loop with DOS).
o CVE-2013-4124:
All current released versions of Samba are vulnerable to a denial of
service on an authenticated or guest connection. A malformed packet
can cause the smbd server to loop the CPU performing memory
allocations and preventing any further service.
A connection to a file share, or a local account is needed to exploit
this problem, either authenticated or unauthenticated if guest
connections are allowed.
This flaw is not exploitable beyond causing the code to loop
allocating memory, which may cause the machine to exceed memory
limits.
Changes since 3.6.16:
---------------------
o Jeremy Allison <jra@samba.org>
* BUG 10010: CVE-2013-4124: Missing integer wrap protection in EA list
reading can cause server to loop with DOS.
136 lines
4.4 KiB
Text
136 lines
4.4 KiB
Text
$NetBSD: patch-af,v 1.12 2013/08/12 02:45:55 taca Exp $
|
|
|
|
--- configure.orig 2013-07-29 18:57:14.000000000 +0000
|
|
+++ configure
|
|
@@ -19513,6 +19513,7 @@ $as_echo "#define DARWINOS 1" >>confdefs
|
|
|
|
BLDSHARED="true"
|
|
LDSHFLAGS="-dynamiclib -flat_namespace -undefined suppress"
|
|
+ SONAMEFLAG="-install_name \$(LIBDIR)/"
|
|
CFLAGS="$CFLAGS -fno-common"
|
|
SHLD="\${CC}"
|
|
SHLIBEXT="dylib"
|
|
@@ -19562,7 +19563,7 @@ fi
|
|
|
|
if test "x$enable_as_needed" != xno; then
|
|
saved_before_as_needed_ldflags="$LDFLAGS"
|
|
- for flags in "-Wl,--as-needed" "-Wl,-z,ignore" "-z ignore" ; do
|
|
+ for flags in "-Wl,-z,ignore" "-z ignore" ; do
|
|
saved_ldflags="$LDFLAGS"
|
|
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking if $flags works" >&5
|
|
$as_echo_n "checking if $flags works... " >&6; }
|
|
@@ -26638,9 +26639,9 @@ LIBS="-lcrypto $KRB5_LIBS $LIBS"
|
|
|
|
|
|
|
|
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking for des_set_key in -lcrypto" >&5
|
|
-$as_echo_n "checking for des_set_key in -lcrypto... " >&6; }
|
|
-if ${ac_cv_lib_ext_crypto_des_set_key+:} false; then :
|
|
+ { $as_echo "$as_me:${as_lineno-$LINENO}: checking for EVP_des_cbc in -lcrypto" >&5
|
|
+$as_echo_n "checking for EVP_des_cbc in -lcrypto... " >&6; }
|
|
+if ${ac_cv_lib_ext_crypto_EVP_des_cbc+:} false; then :
|
|
$as_echo_n "(cached) " >&6
|
|
else
|
|
cat confdefs.h - <<_ACEOF >conftest.$ac_ext
|
|
@@ -26652,31 +26653,31 @@ else
|
|
#ifdef __cplusplus
|
|
extern "C"
|
|
#endif
|
|
-char des_set_key ();
|
|
+char EVP_des_cbc ();
|
|
int
|
|
main ()
|
|
{
|
|
-return des_set_key ();
|
|
+return EVP_des_cbc ();
|
|
;
|
|
return 0;
|
|
}
|
|
_ACEOF
|
|
if ac_fn_c_try_link "$LINENO"; then :
|
|
- ac_cv_lib_ext_crypto_des_set_key=yes;
|
|
+ ac_cv_lib_ext_crypto_EVP_des_cbc=yes;
|
|
ac_cv_lib_ext_crypto=yes
|
|
else
|
|
- ac_cv_lib_ext_crypto_des_set_key=no;
|
|
+ ac_cv_lib_ext_crypto_EVP_des_cbc=no;
|
|
ac_cv_lib_ext_crypto=no
|
|
fi
|
|
rm -f core conftest.err conftest.$ac_objext \
|
|
conftest$ac_exeext conftest.$ac_ext
|
|
|
|
fi
|
|
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ext_crypto_des_set_key" >&5
|
|
-$as_echo "$ac_cv_lib_ext_crypto_des_set_key" >&6; }
|
|
- if test $ac_cv_lib_ext_crypto_des_set_key = yes; then :
|
|
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_ext_crypto_EVP_des_cbc" >&5
|
|
+$as_echo "$ac_cv_lib_ext_crypto_EVP_des_cbc" >&6; }
|
|
+ if test $ac_cv_lib_ext_crypto_EVP_des_cbc = yes; then :
|
|
cat >>confdefs.h <<_ACEOF
|
|
-#define HAVE_DES_SET_KEY 1
|
|
+#define HAVE_EVP_DES_CBC 1
|
|
_ACEOF
|
|
|
|
fi
|
|
@@ -36043,31 +36044,39 @@ case "$host_os" in
|
|
NSSSONAMEVERSIONSUFFIX=".2"
|
|
WINBIND_NSS_EXTRA_OBJS="../nsswitch/winbind_nss_linux.o"
|
|
;;
|
|
- *freebsd[5-9]*)
|
|
- # FreeBSD winbind client is implemented as a wrapper around
|
|
- # the Linux version.
|
|
- NSSSONAMEVERSIONSUFFIX=".1"
|
|
- WINBIND_NSS_EXTRA_OBJS="../nsswitch/winbind_nss_freebsd.o \
|
|
- ../nsswitch/winbind_nss_linux.o"
|
|
- WINBIND_NSS="../nsswitch/nss_winbind.$SHLIBEXT"
|
|
- WINBIND_WINS_NSS="../nsswitch/nss_wins.$SHLIBEXT"
|
|
- ;;
|
|
-
|
|
- *netbsd*[3-9]*)
|
|
- # NetBSD winbind client is implemented as a wrapper
|
|
- # around the Linux version. It needs getpwent_r() to
|
|
- # indicate libc's use of the correct nsdispatch API.
|
|
- #
|
|
- if test x"$ac_cv_func_getpwent_r" = x"yes"; then
|
|
- WINBIND_NSS_EXTRA_OBJS="\
|
|
- ../nsswitch/winbind_nss_netbsd.o \
|
|
+ *freebsd*)
|
|
+ case "$UNAME_R" in
|
|
+ [5-9]*)
|
|
+ # FreeBSD winbind client is implemented as a wrapper
|
|
+ # around the Linux version.
|
|
+ NSSSONAMEVERSIONSUFFIX=".1"
|
|
+ WINBIND_NSS_EXTRA_OBJS="../nsswitch/winbind_nss_freebsd.o \
|
|
../nsswitch/winbind_nss_linux.o"
|
|
WINBIND_NSS="../nsswitch/nss_winbind.$SHLIBEXT"
|
|
WINBIND_WINS_NSS="../nsswitch/nss_wins.$SHLIBEXT"
|
|
- else
|
|
- HAVE_WINBIND=no
|
|
- winbind_no_reason=", getpwent_r is missing on $host_os so winbind is unsupported"
|
|
- fi
|
|
+ ;;
|
|
+ esac
|
|
+ ;;
|
|
+
|
|
+ *netbsd*)
|
|
+ case "$UNAME_R" in
|
|
+ [3-9]*)
|
|
+ # NetBSD winbind client is implemented as a wrapper
|
|
+ # around the Linux version. It needs getpwent_r() to
|
|
+ # indicate libc's use of the correct nsdispatch API.
|
|
+ #
|
|
+ if test x"$ac_cv_func_getpwent_r" = x"yes"; then
|
|
+ WINBIND_NSS_EXTRA_OBJS="\
|
|
+ ../nsswitch/winbind_nss_netbsd.o \
|
|
+ ../nsswitch/winbind_nss_linux.o"
|
|
+ WINBIND_NSS="../nsswitch/nss_winbind.$SHLIBEXT"
|
|
+ WINBIND_WINS_NSS="../nsswitch/nss_wins.$SHLIBEXT"
|
|
+ else
|
|
+ HAVE_WINBIND=no
|
|
+ winbind_no_reason=", getpwent_r is missing on $host_os so winbind is unsupported"
|
|
+ fi
|
|
+ ;;
|
|
+ esac
|
|
;;
|
|
*irix*)
|
|
# IRIX has differently named shared libraries
|