RHBA-2012:0850 - Bug Fix Advisory

Topic

Updated samba packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

Samba is an open-source implementation of the Server Message Block (SMB) and
Common Internet File System (CIFS) protocol, which allows PC-compatible machines
to share files, printers, and other information.

These updated samba packages provide fixes for the following bugs:

• When using Samba with the "password server" configuration setting and when the

given name for that parameter was a hostname that resolved to multiple IP
addresses, Samba did not correctly handle the returned addresses. Consequently,
Samba failed to use one of the password servers and terminate unexpectedly. This
update fixes Samba to correctly process multiple IP addresses when using a
hostname with the "password server" parameter. Samba now works correctly with
multiple IP addresses in the scenario described. (BZ#753143)

• When Samba was configured to operate in an Active Directory (AD) environment

it sometimes created invalid DNS SRV queries. This happened when an empty
sitename was used to compose the SRV record search string. Consequently,
Samba-generated log files contained many DNS related error messages. Samba has
been fixed to always generate a correct DNS SRV query and the DNS-related error
message no longer occur. (BZ#753747)

• The smbclient tool sometimes failed to return the expected exit status code;

it returned 0 instead of 1. Consequently, using smbclient in a script caused
some scripts to fail. With this update, an upstream patch has been applied and
smbclient now returns the correct exit status. (BZ#755347)

• Previously, the Winbind IDMAP interface cache did not expire as specified in

the smb.conf file. Consequently, the positive and negative entries in the cache
would not expire until the opposite type of query was made. This update contains
a backported fix for the problem. As a result, the idmap cache time and idmap
negative cache time directives now work as expected. (BZ#767656)

• When calling "getent passwd" for a user who had no UID, if winbind was joined

to the domain with idmap_ad specified as the backend, enumerating users was
enabled, and most of the users had UIDs, the enumeration stopped and the
following error was displayed:

NT_STATUS_NONE_MAPPED

This update implements an upstream patch to correct the problem. As a result, if
a user cannot be mapped, winbind no longer stops but continues enumerating users
in the scenario described. (BZ#767659)

• Samba sometimes generated many debug messages such as "Could not find child

XXXX -- ignoring" that were written to syslog. Consequently, although these
messages are not critical, syslog could be flooded by the large amount of these
messages. Samba has been fixed to no longer issue this message to syslog
automatically and syslog is no longer flooded by these samba debug messages.
(BZ#771812)

• The pam_winbind utility used an undocumented PAM_RADIO_TYPE message which has

no documented semantics. This caused the login manager gdm to terminate
unexpectedly when pam_winbind was used on the system. Consequently, users could
not log in when using pam_winbind. Samba has been fixed to not use the
PAM_RADIO_TYPE message. Users can now use pam_winbind for authentication in GDM.
(BZ#788089)

• Newer versions of Windows could not properly set Access Control Lists (ACLs)

on a Samba share. The users were receiving an "access denied" warning.
Consequently, administrators or users could not fully control ACLs on a Samba
share. This update fixes the problem in Samba and ACLs can now be used as
expected. (BZ#808449)

• An update of the system Kerberos library to a recent version made Samba

binaries and libraries suddenly unusable because Samba was using a private
library symbol. Consequently, Samba was no longer usable after a Kerberos
update. This update corrects Samba to no longer use that private symbol. Samba
now continues to operate when the Kerberos library has been updated. (BZ#816123)

All users of samba are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 808449 - smb_acl_to_posix: ACL is invalid for set (Invalid argument)
• BZ - 816123 - samba's use of (private) krb5_locate_kdc() broken by krb5-1.10

CVEs

(none)

References

(none)