Changeset 491 for branches


Ignore:
Timestamp:
Sep 16, 2010, 10:06:10 AM (15 years ago)
Author:
Herwig Bauernfeind
Message:

Update Samba 3.3 to 3.3.14 (security update)

Location:
branches/samba-3.3.x
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • branches/samba-3.3.x/WHATSNEW.txt

    r467 r491  
    11                   ==============================
    2                    Release Notes for Samba 3.3.13
    3                             June 16, 2010
     2                   Release Notes for Samba 3.3.14
     3                         September 14, 2010
    44                   ==============================
    55
    66
    7 This is a security release in order to address CVE-2010-2063.
    8 
    9 
    10 o  CVE-2010-2063:
    11    In Samba 3.3.x and below, a buffer overrun is possible in chain_reply code.
    12 
    13 
    14 Changes since 3.3.12
     7This is a security release in order to address CVE-2010-3069.
     8
     9
     10o  CVE-2010-3069:
     11   All current released versions of Samba are vulnerable to
     12   a buffer overrun vulnerability. The sid_parse() function
     13   (and related dom_sid_parse() function in the source4 code)
     14   do not correctly check their input lengths when reading a
     15   binary representation of a Windows SID (Security ID). This
     16   allows a malicious client to send a sid that can overflow
     17   the stack variable that is being used to store the SID in the
     18   Samba smbd server.
     19
     20
     21Changes since 3.3.13
    1522--------------------
    1623
    1724
    1825o   Jeremy Allison <jra@samba.org>
    19     * BUG 7494: Fix for CVE-2010-2063.
     26    * BUG 7669: Fix for CVE-2010-3069.
     27
     28
     29o   Andrew Bartlett <abartlet@samba.org>
     30    * BUG 7669: Fix for CVE-2010-3069.
    2031
    2132
    … …  
    4253Release notes for older releases follow:
    4354----------------------------------------
     55
     56                   ==============================
     57                   Release Notes for Samba 3.3.13
     58                            June 16, 2010
     59                   ==============================
     60
     61
     62This is a security release in order to address CVE-2010-2063.
     63
     64
     65o  CVE-2010-2063:
     66   In Samba 3.3.x and below, a buffer overrun is possible in chain_reply code.
     67
     68
     69Changes since 3.3.12
     70--------------------
     71
     72
     73o   Jeremy Allison <jra@samba.org>
     74    * BUG 7494: Fix for CVE-2010-2063.
     75
     76
     77######################################################################
     78Reporting bugs & Development Discussion
     79#######################################
     80
     81Please discuss this release on the samba-technical mailing list or by
     82joining the #samba-technical IRC channel on irc.freenode.net.
     83
     84If you do report problems then please try to send high quality
     85feedback. If you don't provide vital information to help us track down
     86the problem then you will probably be ignored.  All bug reports should
     87be filed under the Samba 3.3 product in the project's Bugzilla
     88database (https://bugzilla.samba.org/).
     89
     90
     91======================================================================
     92== Our Code, Our Bugs, Our Responsibility.
     93== The Samba Team
     94======================================================================
     95
     96
     97----------------------------------------------------------------------
     98
    4499
    45100                   ==============================

  • branches/samba-3.3.x/packaging/RHEL-CTDB/samba.spec

    r467 r491  
    66Packager: Samba Team <samba@samba.org>
    77Name:         samba
    8 Version:      3.3.13
     8Version:      3.3.14
    99Release:      ctdb.1
    1010Epoch:        0

  • branches/samba-3.3.x/packaging/RHEL/makerpms.sh

    r467 r491  
    2121USERID=`id -u`
    2222GRPID=`id -g`
    23 VERSION='3.3.13'
     23VERSION='3.3.14'
    2424REVISION=''
    2525SPECFILE="samba.spec"

  • branches/samba-3.3.x/packaging/RHEL/samba.spec

    r467 r491  
    66Packager: Samba Team <samba@samba.org>
    77Name:         samba
    8 Version:      3.3.13
     8Version:      3.3.14
    99Release:      1
    1010Epoch:        0

  • branches/samba-3.3.x/source/VERSION

    r467 r491  
    2626SAMBA_VERSION_MAJOR=3
    2727SAMBA_VERSION_MINOR=3
    28 SAMBA_VERSION_RELEASE=13
     28SAMBA_VERSION_RELEASE=14
    2929
    3030########################################################

  • branches/samba-3.3.x/source/lib/util_sid.c

    r206 r491  
    409409        sid->sid_rev_num = CVAL(inbuf, 0);
    410410        sid->num_auths = CVAL(inbuf, 1);
     411        if (sid->num_auths > MAXSUBAUTHS) {
     412                return false;
     413        }
    411414        memcpy(sid->id_auth, inbuf+2, 6);
    412415        if (len < 8 + sid->num_auths*4)

  • branches/samba-3.3.x/source/libads/ldap.c

    r224 r491  
    21402140                DOM_SID sid;
    21412141                fstring tmp;
    2142                 sid_parse(values[i]->bv_val, values[i]->bv_len, &sid);
     2142                if (!sid_parse(values[i]->bv_val, values[i]->bv_len, &sid)) {
     2143                        continue;
     2144                }
    21432145                printf("%s: %s\n", field, sid_to_fstring(tmp, &sid));
    21442146        }

  • branches/samba-3.3.x/source/libsmb/cliquota.c

    r206 r491  
    118118#endif /* LARGE_SMB_OFF_T */
    119119
    120         sid_parse(rdata+40,sid_len,&qt.sid);
     120        if (!sid_parse(rdata+40,sid_len,&qt.sid)) {
     121                return false;
     122        }
    121123
    122124        qt.qtype = SMB_USER_QUOTA_TYPE;

  • branches/samba-3.3.x/source/smbd/nttrans.c

    r370 r491  
    19511951                /*unknown = IVAL(pdata,0);*/
    19521952
    1953                 sid_parse(pdata+4,sid_len,&sid);
     1953                if (!sid_parse(pdata+4,sid_len,&sid)) {
     1954                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
     1955                        return;
     1956                }
     1957
    19541958                DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
    19551959
    … …  
    22072211                        }
    22082212
    2209                         sid_parse(pdata+8,sid_len,&sid);
     2213                        if (!sid_parse(pdata+8,sid_len,&sid)) {
     2214                                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
     2215                                return;
     2216                        }
    22102217
    22112218                        if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
    … …  
    23882395#endif /* LARGE_SMB_OFF_T */
    23892396
    2390         sid_parse(pdata+40,sid_len,&sid);
     2397        if (!sid_parse(pdata+40,sid_len,&sid)) {
     2398                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
     2399                return;
     2400        }
     2401
    23912402        DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
    23922403
Note: See TracChangeset for help on using the changeset viewer.