[SCM] Samba Website Repository - branch master updated
Karolin Seeger
kseeger at samba.org
Wed Jun 16 04:16:15 MDT 2010
The branch, master has been updated
via 58fb2dd... Announce Samba 3.3.13.
from 1ec7d0e... patches/index: Change headline.
http://gitweb.samba.org/?p=samba-web.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 58fb2dd313314534da600dc30fa1bf163f614835
Author: Karolin Seeger <kseeger at samba.org>
Date: Wed Jun 16 12:15:55 2010 +0200
Announce Samba 3.3.13.
Karolin
-----------------------------------------------------------------------
Summary of changes:
history/header_history.html | 1 +
history/samba-3.3.13.html | 37 +++++++++++++++++++
history/security.html | 12 ++++++
security/CVE-2010-2063.html | 82 +++++++++++++++++++++++++++++++++++++++++++
4 files changed, 132 insertions(+), 0 deletions(-)
create mode 100755 history/samba-3.3.13.html
create mode 100644 security/CVE-2010-2063.html
Changeset truncated at 500 lines:
diff --git a/history/header_history.html b/history/header_history.html
index eafb0df..abcbd61 100755
--- a/history/header_history.html
+++ b/history/header_history.html
@@ -22,6 +22,7 @@
<li><a href="samba-3.4.2.html">samba-3.4.2</a></li>
<li><a href="samba-3.4.1.html">samba-3.4.1</a></li>
<li><a href="samba-3.4.0.html">samba-3.4.0</a></li>
+ <li><a href="samba-3.3.13.html">samba-3.3.13</a></li>
<li><a href="samba-3.3.12.html">samba-3.3.12</a></li>
<li><a href="samba-3.3.11.html">samba-3.3.11</a></li>
<li><a href="samba-3.3.10.html">samba-3.3.10</a></li>
diff --git a/history/samba-3.3.13.html b/history/samba-3.3.13.html
new file mode 100755
index 0000000..ea64897
--- /dev/null
+++ b/history/samba-3.3.13.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<title>Samba - Release Notes Archive</title>
+</head>
+
+<body>
+
+ <H2>Samba 3.3.13 Available for Download</H2>
+
+<p>
+<pre>
+ ==============================
+ Release Notes for Samba 3.3.13
+ June 16, 2010
+ ==============================
+
+
+This is a security release in order to address CVE-2010-2063.
+
+
+o CVE-2010-2063:
+ In Samba 3.3.x and below, a buffer overrun is possible in chain_reply code.
+
+
+Changes since 3.3.12
+--------------------
+
+
+o Jeremy Allison <jra at samba.org>
+ * BUG 7494: Fix for CVE-2010-2063.
+</pre>
+
+</body>
+</html>
diff --git a/history/security.html b/history/security.html
index 482c1d3..98fcb58 100755
--- a/history/security.html
+++ b/history/security.html
@@ -22,6 +22,18 @@ link to full release notes for each release.</p>
</tr>
<tr>
+ <td>16 Jun 2010</td>
+ <td><a href="/samba/ftp/patches/security/samba-3.3.12-CVE-2010-2063.patch">
+ patch for Samba 3.3.12 and 3.2.15</a>
+ <a href="/samba/ftp/patches/security/samba-3.0.37-CVE-2010-2063.patch">
+ patch for Samba 3.0.37</a>
+ <td>Memory Corruption Vulnerability</td>
+ <td>3.0.x, 3.2.x, 3.3.0-3.3.12</td>
+ <td><a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0728">CVE-2010-2063</a></td>
+ <td><a href="/samba/security/CVE-2010-2063.html">Announcement</a></td>
+ </tr>
+
+ <tr>
<td>08 Mar 2010</td>
<td><a href="/samba/ftp/patches/security/samba-3.5.0-CVE-2010-0728.patch">
patch for Samba 3.5.0</a>
diff --git a/security/CVE-2010-2063.html b/security/CVE-2010-2063.html
new file mode 100644
index 0000000..658e6f0
--- /dev/null
+++ b/security/CVE-2010-2063.html
@@ -0,0 +1,82 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<title>Samba - Security Announcement Archive</title>
+</head>
+
+<body>
+
+ <H2>CVE-2010-2063: </H2>
+
+<p>
+<pre>
+===========================================================
+== Subject: Memory Corruption Vulnerability
+==
+== CVE ID#: CVE-2010-2063
+==
+== Versions: Samba 3.0.x - 3.3.12 (inclusive)
+==
+== Summary: Samba 3.0.x to 3.3.12 are affected by a
+== memory corruption vulnerability.
+==
+===========================================================
+
+===========
+Description
+===========
+
+Samba versions 3.3.12 and all versions previous to this are affected
+by a memory corruption vulnerability. Samba versions 3.4.0 and all
+releases since this version are *NOT* affected by this problem. In
+particular, the current stable Samba version 3.5.3 is *NOT* affected
+by this problem.
+
+Code dealing with the chaining of SMB1 packets did not correctly
+validate an input field provided by the client, making it possible
+for a specially crafted packet to crash the server or potentially
+cause the server to execute arbitrary code.
+
+This does not require an authenticated connection and so is the
+most dangerous kind of vulnerability. All affected systems should
+be patched as soon as possible.
+
+==================
+Patch Availability
+==================
+
+Patches addressing both these issues have been posted to:
+
+ http://www.samba.org/samba/security/
+
+Additionally, Samba 3.3.13 has been issued as security release to correct the
+defect. Patches against older Samba versions are available at
+http://samba.org/samba/patches/. Samba administrators running affected
+versions are advised to upgrade to 3.3.13 or apply the patch as soon
+as possible.
+
+
+==========
+Workaround
+==========
+
+None.
+
+=======
+Credits
+=======
+
+This vulnerability and proof of concept code was provided by
+Jun Mao of iDefense Labs (http://www.idefense.com).
+
+Patches were provided by Jeremy Allison of the Samba team.
+
+==========================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+==========================================================
+</pre>
+</body>
+</html>
--
Samba Website Repository
More information about the samba-cvs
mailing list