./net/samba4, SMB/CIFS protocol server suite

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]

Branch: pkgsrc-2021Q4, Version: 4.13.17, Package name: samba-4.13.17, Maintainer: pkgsrc-users

Samba is the standard Windows interoperability suite of programs
for Linux and Unix.

Samba is Free Software licensed under the GNU General Public License,
the Samba project is a member of the Software Freedom Conservancy.

Since 1992, Samba has provided secure, stable and fast file and
print services for all clients using the SMB/CIFS protocol, such
as all versions of DOS and Windows, OS/2, Linux and many others.

Samba is an important component to seamlessly integrate Linux/Unix
Servers and Desktops into Active Directory environments. It can
function both as a domain controller or as a regular domain member.

This package intends to provide the current stable version of samba
within the 4.x series. (As will all packages, it may of course
sometimes contain an older stable release due to not being updated
yet.)

MESSAGE.rcd [+/-]


Package options: ads, avahi, ldap, pam, winbind

Master sites:

Filesize: 18508.622 KB

Version history: (Expand)

CVS history: (Expand)


   2022-02-06 20:11:23 by Benny Siegert | Files touched by this commit (2) 
Log message:
Pullup ticket #6577 - requested by taca
net/samba4: security fix

Revisions pulled up:
- net/samba4/Makefile                                           1.136-1.137
- net/samba4/distinfo                                           1.72

---
   Module Name:	pkgsrc
   Committed By:	gdt
   Date:		Tue Jan 25 19:25:01 UTC 2022

   Modified Files:
   	pkgsrc/net/samba4: Makefile

   Log message:
   net/samba4: Add upstream bug report URL

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Jan 31 13:45:12 UTC 2022

   Modified Files:
   	pkgsrc/net/samba4: Makefile distinfo

   Log message:
   net/samba4: udpate to 4.13.17

                      ===============================
                      Release Notes for Samba 4.13.17
                             January 31, 2022
                      ===============================

   This is a security release in order to address the following defects:

   o CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module.
                     https://www.samba.org/samba/security/CVE-2021-44142.html

   o CVE-2022-0336:  Re-adding an SPN skips subsequent SPN conflict checks.
                     https://www.samba.org/samba/security/CVE-2022-0336.html

   Changes since 4.13.16
   ---------------------

   o  Ralph Boehme <slow@samba.org>
      * BUG 14914: CVE-2021-44142

   o  Joseph Sutton <josephsutton@catalyst.net.nz>
      * BUG 14950: CVE-2022-0336
   2022-01-21 16:49:25 by Benny Siegert | Files touched by this commit (2) | Package updated
Log message:
Pullup ticket #6572 - requested by taca
net/samba4: security fix

Revisions pulled up:
- net/samba4/Makefile                                           1.135
- net/samba4/distinfo                                           1.71

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Mon Jan 10 14:11:16 UTC 2022

   Modified Files:
   	pkgsrc/net/samba4: Makefile distinfo

   Log message:
   net/samba4: update to 4.13.16

                      ===============================
                      Release Notes for Samba 4.13.16
                             January 10, 2022
                      ===============================

   This is a security release in order to address the following defects:

   o CVE-2021-43566:  mkdir race condition allows share escape in Samba 4.x.
                      https://www.samba.org/samba/security/CVE-2021-43566.html

   =======
   Details
   =======

   o  CVE-2021-43566:
      All versions of Samba prior to 4.13.16 are vulnerable to a malicious
      client using an SMB1 or NFS symlink race to allow a directory to be
      created in an area of the server file system not exported under the
      share definition. Note that SMB1 has to be enabled, or the share
      also available via NFS in order for this attack to succeed.

      Clients that have write access to the exported part of the file system
      under a share via SMB1 unix extensions or NFS can create symlinks that
      can race the server by renaming an existing path and then replacing it
      with a symlink. If the client wins the race it can cause the server to
      create a directory under the new symlink target after the exported
      share path check has been done. This new symlink target can point to
      anywhere on the server file system. The authenticated user must have
      permissions to create a directory under the target directory of the
      symlink.

      This is a difficult race to win, but theoretically possible. Note that
      the proof of concept code supplied wins the race only when the server
      is slowed down and put under heavy load. Exploitation of this bug has
      not been seen in the wild.

   Changes since 4.13.15
   ---------------------

   o  Jeremy Allison <jra@samba.org>
      * BUG 13979: CVE-2021-43566: mkdir race condition allows share escape in \ 
Samba 4.x