RHBA-2011:0054 - Bug Fix Advisory

Topic

Updated samba3x packages that fix several bugs and add various enhancements are
now available.

Description

Samba is a suite of programs used by machines for authentication, and file and
printer sharing.

These updated samba3x packages provide fixes for the following bugs:

• Users of trusted child domains were not authenticated correctly. As a result,

some users of such domains did not appear as members of the parent domain even
if the child domain allowed full inheriting from the parent domain. With this
update, all users of a trusted child domain are authenticated successfully.
(BZ#459842)

• The smb.conf manual page contained an ambiguous description of the 'default

case' parameter. With this update, the description is updated and gives a clear
description. (BZ#480405)

• Service principal names were not always created correctly and as a result, the

system was attempting to acquire a service ticket using a wrong hostname. This
caused the Kerberos authentication to fail. With this update, service principal
names are created correctly. (BZ#560239)

• CUPS printing could fail in an Active Directory environment with Kerberos.

With this update, regular users can print in such environment. (BZ#565774)

• When the 'normalize names' setting was enabled, the winbindd service could

have failed after user authentication. With this update, authentication is
successful. (BZ#565915)

• Packages requiring samba cannot recognize samba3x as an updated samba version.

With this update, dependent packages recognize samba3x as the new samba version.
(BZ#582756)

• Some remote users could not authenticate from workstations running Windows.

This occurred, because the winbind service failed to authenticate to Windows
Server 2008 using the "ntlm-server-1" ntm_auth protocol. With this update, the
service works correctly. (BZ#590766)

• In the offline mode, the winbind service could have logged the following

message: "Exceeding 200 client connections, no idle connection found." With this
update, the error no longer occurs and you can set the client limit manually
with the command 'winbind max clients'. (BZ#604081)

• The winbindd client limit was set to 200 and could not be changed. With this

update, you can set the client limit manually with the command 'winbind max
clients'. (BZ#641379)

• Previously, the samba3x package considered any samba package a conflicting

package. With this update, samba3x checks for possible non-conflicting versions
of the samba package. (BZ#609578)

• When using non-standard character sets, the command 'wbinfo' displayed user

and group names with accented characters incorrectly. With this update, those
names are displayed correctly with all supported character sets. (BZ#649708)

• Samba could have failed to connect to workstations running Windows 7 with Live

Essentials installed due to a SPNEGO parsing failure. With this update, the
connection succeeds. (BZ#651722)

In addition, these updated packages provide the following enhancements:

• Interoperation with Windows 7 and Windows Server 2008 was fixed. Secure

channel connections to servers with Windows Server 2008 R2 and interdomain
trusts with Windows Server 2008 domains are now supported. Previously also, due
to errors in the secure channel to Windows 7 and Windows Server 2008 R2, the
winbind daemon could corrupt the secure channel. With this update, this no
longer occurs. (BZ#527997)

• In Red Hat Enterprise Linux 5.6, the samba3x package no longer provides the

libtalloc library. The library is now provided in a separate source RPM.
(BZ#596883)

• In Red Hat Enterprise Linux 5.6, the samba3x package no longer provides the

libtdb library. The library is now provided in a separate source RPM.
(BZ#596886)

Users are advised to upgrade to these updated samba3x packages, which resolve
these issues and add these enhancements.

Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat
Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 459842 - Regression bug enumerating users in Windows 2003 parent and trusted domains when in a child domain
• BZ - 480405 - 'default case' parameter description in smb.conf(5) is confusing
• BZ - 527997 - Interoperation with Windows 7 and Windows 2008 (R2) broken
• BZ - 560239 - cliconnect gets realm wrong with trusted domains
• BZ - 565774 - CUPS cannot print with smbspool backend in AD / Kerberos environment
• BZ - 565915 - winbindd dumps core after authentication when normalize names is enabled.
• BZ - 568778 - samba-swat does not properly store group names with spaces in them
• BZ - 582756 - Packages that require samba have a conflict when samba3x is installed
• BZ - 590610 - Samba3x crashes when logfile rotation occurs
• BZ - 590766 - Winbind fails on ntlm-server-1 with Windows 2008 server
• BZ - 596886 - samba3x should stop building libtdb
• BZ - 609578 - Version the conflicts against samba-X
• BZ - 641379 - Change the limit of winbindd clients dynamically
• BZ - 643041 - Samba3x Failing to rebuild because of package splits
• BZ - 649708 - samba: charset issues on the filenames
• BZ - 651722 - All samba versions before 3.5.6 fail to "smbclient" to Win7 with Live Essentials

CVEs

• CVE-2010-0547
• CVE-2010-0787

References

(none)