[SCM] Samba Shared Repository - branch v4-1-stable updated
Karolin Seeger
kseeger at samba.org
Mon Feb 23 03:24:48 MST 2015
The branch, v4-1-stable has been updated
via 492c673 VERSION: Disable git snapshots for the 4.1.17 release.
via 8f38d4b WHATSNEW: Add release notes for Samba 4.1.17.
via a9a513c s3-netlogon: Make sure we do not deference a NULL pointer.
via 1996b18 CVE-2015-0240: s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer.
via 5a59b1a VERSION: Re-enable git snapshots.
via e001101 VERSION: Bump version up to 4.1.17.
from 1e682c3 VERSION: Disable git snapshots for the 4.1.16 release.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-1-stable
- Log -----------------------------------------------------------------
commit 492c673de07d68e0e937ca584302fef577318b24
Author: Karolin Seeger <kseeger at samba.org>
Date: Sat Feb 21 21:04:20 2015 +0100
VERSION: Disable git snapshots for the 4.1.17 release.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077
CVE-2015-0240: talloc free on uninitialized stack pointer in netlogon server
could lead to security vulnerability.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit 8f38d4b5e4ba45d8cc365e150f6e259d8272367c
Author: Karolin Seeger <kseeger at samba.org>
Date: Sat Feb 21 21:07:08 2015 +0100
WHATSNEW: Add release notes for Samba 4.1.17.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077
CVE-2015-0240: talloc free on uninitialized stack pointer in netlogon server
could lead to security vulnerability.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit a9a513c926209aa084991528d0f6ab84b20da5f7
Author: Andreas Schneider <asn at samba.org>
Date: Mon Feb 16 10:59:23 2015 +0100
s3-netlogon: Make sure we do not deference a NULL pointer.
This is an additional patch for CVE-2015-0240.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077#c32
Pair-Programmed-With: Michael Adam <obnox at samba.org>
Pair-Programmed-With: Andreas Schneider <asn at samba.org>
Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
commit 1996b18510a63a2619d813113c6b57e4654be318
Author: Jeremy Allison <jra at samba.org>
Date: Wed Jan 28 14:47:31 2015 -0800
CVE-2015-0240: s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11077
Signed-off-by: Jeremy Allison <jra at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
commit 5a59b1a8184fe3b483e4f19e024de39b667041ef
Author: Karolin Seeger <kseeger at samba.org>
Date: Tue Feb 10 21:30:36 2015 +0100
VERSION: Re-enable git snapshots.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit e001101a9cd49dadc5b818cc7a0c490a305099eb
Author: Karolin Seeger <kseeger at samba.org>
Date: Thu Jan 15 12:10:58 2015 +0100
VERSION: Bump version up to 4.1.17.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
(cherry picked from commit c4e46cd4e32ef5bf25f3a21f74bb40dfb1dd3c0d)
-----------------------------------------------------------------------
Summary of changes:
VERSION | 2 +-
WHATSNEW.txt | 62 +++++++++++++++++++++++++++--
source3/rpc_server/netlogon/srv_netlog_nt.c | 13 +++++-
3 files changed, 71 insertions(+), 6 deletions(-)
Changeset truncated at 500 lines:
diff --git a/VERSION b/VERSION
index 47509cb..8876650 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
########################################################
SAMBA_VERSION_MAJOR=4
SAMBA_VERSION_MINOR=1
-SAMBA_VERSION_RELEASE=16
+SAMBA_VERSION_RELEASE=17
########################################################
# If a official release has a serious bug #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 81a1d56..48ebdf9 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,62 @@
==============================
+ Release Notes for Samba 4.1.17
+ February 23, 2015
+ ==============================
+
+
+This is a security release in order to address CVE-2015-0240 (Unexpected
+code execution in smbd).
+
+o CVE-2015-0240:
+ All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an
+ unexpected code execution vulnerability in the smbd file server
+ daemon.
+
+ A malicious client could send packets that may set up the stack in
+ such a way that the freeing of memory in a subsequent anonymous
+ netlogon packet could allow execution of arbitrary code. This code
+ would execute with root privileges.
+
+
+Changes since 4.1.16:
+---------------------
+
+o Jeremy Allison <jra at samba.org>
+ * BUG 11077: CVE-2015-0240: talloc free on uninitialized stack pointer
+ in netlogon server could lead to security vulnerability.
+
+
+o Andreas Schneider <asn at samba.org>
+ * BUG 11077: CVE-2015-0240: s3-netlogon: Make sure we do not deference
+ a NULL pointer.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 4.1 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
+======================================================================
+
+ ==============================
Release Notes for Samba 4.1.16
January 15, 2015
==============================
@@ -44,10 +102,8 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older releases follow:
-----------------------------------------
+-----------------------------------------------------------------------
-======================================================================
==============================
Release Notes for Samba 4.1.15
diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
index c903ae8..2ba3278 100644
--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
@@ -1101,6 +1101,10 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,
bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
struct loadparm_context *lp_ctx;
+ if (creds_out != NULL) {
+ *creds_out = NULL;
+ }
+
if (schannel_global_required) {
status = schannel_check_required(&p->auth,
computer_name,
@@ -1258,7 +1262,7 @@ NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p,
{
NTSTATUS status = NT_STATUS_OK;
int i;
- struct netlogon_creds_CredentialState *creds;
+ struct netlogon_creds_CredentialState *creds = NULL;
DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
@@ -1271,9 +1275,14 @@ NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p,
unbecome_root();
if (!NT_STATUS_IS_OK(status)) {
+ const char *computer_name = "<unknown>";
+
+ if (creds != NULL && creds->computer_name != NULL) {
+ computer_name = creds->computer_name;
+ }
DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
"request from client %s machine account %s\n",
- r->in.computer_name, creds->computer_name));
+ r->in.computer_name, computer_name));
TALLOC_FREE(creds);
return status;
}
--
Samba Shared Repository
More information about the samba-cvs
mailing list