Subject: CVS commit: pkgsrc/net/samba4
From: Takahiro Kambe
Date: 2023-10-10 18:05:01
Message id: 20231010160501.58BA3FADC@cvs.NetBSD.org

Log Message:
net/samba4: update to 4.18.8

                   ==============================
                   Release Notes for Samba 4.18.8
                          October 10, 2023
                   ==============================

This is a security release in order to address the following defects:

o CVE-2023-3961:  Unsanitized pipe names allow SMB clients to connect as root to
                  existing unix domain sockets on the file system.
                  https://www.samba.org/samba/security/CVE-2023-3961.html

o CVE-2023-4091:  SMB client can truncate files to 0 bytes by opening files with
                  OVERWRITE disposition when using the acl_xattr Samba VFS
                  module with the smb.conf setting
                  "acl_xattr:ignore system acls = yes"
                  https://www.samba.org/samba/security/CVE-2023-4091.html

o CVE-2023-4154:  An RODC and a user with the GET_CHANGES right can view all
                  attributes, including secrets and passwords.  Additionally,
                  the access check fails open on error conditions.
                  https://www.samba.org/samba/security/CVE-2023-4154.html

o CVE-2023-42669: Calls to the rpcecho server on the AD DC can request that the
                  server block for a user-defined amount of time, denying
                  service.
                  https://www.samba.org/samba/security/CVE-2023-42669.html

o CVE-2023-42670: Samba can be made to start multiple incompatible RPC
                  listeners, disrupting service on the AD DC.
                  https://www.samba.org/samba/security/CVE-2023-42670.html

Files:
RevisionActionfile
1.171modifypkgsrc/net/samba4/Makefile
1.52modifypkgsrc/net/samba4/PLIST
1.98modifypkgsrc/net/samba4/distinfo