3.79. samba and samba3x

Security Fixes

CVE-2013-4408

A heap-based buffer overflow flaw was found in the DCE-RPC client code in Samba. A specially crafted DCE-RPC packet could cause various Samba programs to crash or, possibly, execute arbitrary code when parsed. A malicious or compromised Active Directory Domain Controller could use this flaw to compromise the winbindd daemon running with root privileges.

CVE-2013-4475

A flaw was found in the way Samba performed ACL checks on alternate file and directory data streams. An attacker able to access a CIFS share with alternate stream support enabled could access alternate data streams regardless of the underlying file or directory ACL permissions.

Security Fixes

CVE-2013-4496

It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller.

CVE-2012-6150

A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service.

Bug Fixes

BZ#1109436

Due to incorrect Security Identifier (SID) mappings for Access Control List (ACL) files, generating a user access token previously sometimes failed. With this update, the conversion of SID values for ACL files has been amended and user access tokens are created as expected.

BZ#981369

Prior to this update, an incorrect return value check caused the fallback from TCP/IP to a named pipe to fail. As a consequence, it was not possible to create a Local Security Authority (LSA) query for user and group information. This update fixes the check of the above return value, allowing the fallback to a named pipe to occur. As a result, LSA querying over a named pipe now works as expected.

BZ#1033773

Prior to this update, the search string of the function encoding the Lightweight Directory Access Protocol (LDAP) binary, ldb_binary_encode(), detected the used character set incorrectly. As a consequence, Samba generated invalid search strings. This update fixes the encoding of the local string, and Samba now generates valid LDAP search strings.

BZ#1081002

Previously, Samba always wrote a negative cache entry for the user map. As a consequence, user name mapping did not function consistently. With this update, Samba only writes a negative cache entry if the mapping fails, and user name mapping now works correctly.

BZ#996656

When the smbd server daemon executed spooling for a print action, it previously did not include the job ID in the generated spool-file path. As a consequence, the spool check could not validate the spool-file's existence, and the printing thus failed. With this update, smbd includes the job ID in the spool-file path and parsing the file name succeeds. As a result, printing via Samba now works as expected.

Enhancements

BZ#1037273

A timeout option has been added to the smbclient command-line tool. This allows users to customize the timeout value for Samba file operations by using the "smbclient --help | grep timeout" command.

BZ#1101922

It is now possible to set a different OS version for the Spool Subsystem (spoolss) configuration. This allows users to work around situations where printing drivers do not interact with the printing server because they detect that the version of the printing server is too old.