[SCM] Samba Shared Repository - branch v4-1-test updated
Karolin Seeger
kseeger at samba.org
Mon Feb 23 06:39:12 MST 2015
The branch, v4-1-test has been updated
via dd89495 VERSION: Bump version up to 4.1.18.
via 87c7063 VERSION: Disable git snapshots for the 4.1.17 release.
via 563010d WHATSNEW: Add release notes for Samba 4.1.17.
via 4a312e2 s3-netlogon: Make sure we do not deference a NULL pointer.
via 2b037f7 CVE-2015-0240: s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer.
from 99fe2d6 s3: smbclient: Allinfo leaves the file handle open.
https://git.samba.org/?p=samba.git;a=shortlog;h=v4-1-test
- Log -----------------------------------------------------------------
commit dd89495cc926aa9c8d5fd33d89bdd5e4a6d907e1
Author: Karolin Seeger <kseeger at samba.org>
Date: Mon Feb 23 14:38:08 2015 +0100
VERSION: Bump version up to 4.1.18.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit 87c7063c265ed9f264f34c73595a47b561796c04
Author: Karolin Seeger <kseeger at samba.org>
Date: Sat Feb 21 21:04:20 2015 +0100
VERSION: Disable git snapshots for the 4.1.17 release.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077
CVE-2015-0240: talloc free on uninitialized stack pointer in netlogon server
could lead to security vulnerability.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit 563010d828c66461552a62b64ce79682d3d157bb
Author: Karolin Seeger <kseeger at samba.org>
Date: Sat Feb 21 21:07:08 2015 +0100
WHATSNEW: Add release notes for Samba 4.1.17.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077
CVE-2015-0240: talloc free on uninitialized stack pointer in netlogon server
could lead to security vulnerability.
Signed-off-by: Karolin Seeger <kseeger at samba.org>
commit 4a312e279c1373c791406bd42aded265f07db008
Author: Andreas Schneider <asn at samba.org>
Date: Mon Feb 16 10:59:23 2015 +0100
s3-netlogon: Make sure we do not deference a NULL pointer.
This is an additional patch for CVE-2015-0240.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077#c32
Pair-Programmed-With: Michael Adam <obnox at samba.org>
Pair-Programmed-With: Andreas Schneider <asn at samba.org>
Signed-off-by: Michael Adam <obnox at samba.org>
Signed-off-by: Andreas Schneider <asn at samba.org>
Reviewed-by: Volker Lendecke <vl at samba.org>
commit 2b037f7e3ad5093fa8e715905f2f0379ad5552f4
Author: Jeremy Allison <jra at samba.org>
Date: Wed Jan 28 14:47:31 2015 -0800
CVE-2015-0240: s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11077
Signed-off-by: Jeremy Allison <jra at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
-----------------------------------------------------------------------
Summary of changes:
VERSION | 4 +-
WHATSNEW.txt | 62 +++++++++++++++++++++++++++--
source3/rpc_server/netlogon/srv_netlog_nt.c | 13 +++++-
3 files changed, 72 insertions(+), 7 deletions(-)
Changeset truncated at 500 lines:
diff --git a/VERSION b/VERSION
index d5fd4a8..5237bce 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
########################################################
SAMBA_VERSION_MAJOR=4
SAMBA_VERSION_MINOR=1
-SAMBA_VERSION_RELEASE=17
+SAMBA_VERSION_RELEASE=18
########################################################
# If a official release has a serious bug #
@@ -99,7 +99,7 @@ SAMBA_VERSION_RC_RELEASE=
# e.g. SAMBA_VERSION_IS_SVN_SNAPSHOT=yes #
# -> "3.0.0-SVN-build-199" #
########################################################
-SAMBA_VERSION_IS_GIT_SNAPSHOT=yes
+SAMBA_VERSION_IS_GIT_SNAPSHOT=no
########################################################
# This is for specifying a release nickname #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 81a1d56..48ebdf9 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,62 @@
==============================
+ Release Notes for Samba 4.1.17
+ February 23, 2015
+ ==============================
+
+
+This is a security release in order to address CVE-2015-0240 (Unexpected
+code execution in smbd).
+
+o CVE-2015-0240:
+ All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an
+ unexpected code execution vulnerability in the smbd file server
+ daemon.
+
+ A malicious client could send packets that may set up the stack in
+ such a way that the freeing of memory in a subsequent anonymous
+ netlogon packet could allow execution of arbitrary code. This code
+ would execute with root privileges.
+
+
+Changes since 4.1.16:
+---------------------
+
+o Jeremy Allison <jra at samba.org>
+ * BUG 11077: CVE-2015-0240: talloc free on uninitialized stack pointer
+ in netlogon server could lead to security vulnerability.
+
+
+o Andreas Schneider <asn at samba.org>
+ * BUG 11077: CVE-2015-0240: s3-netlogon: Make sure we do not deference
+ a NULL pointer.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 4.1 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
+======================================================================
+
+ ==============================
Release Notes for Samba 4.1.16
January 15, 2015
==============================
@@ -44,10 +102,8 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older releases follow:
-----------------------------------------
+-----------------------------------------------------------------------
-======================================================================
==============================
Release Notes for Samba 4.1.15
diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
index c903ae8..2ba3278 100644
--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
@@ -1101,6 +1101,10 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p,
bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
struct loadparm_context *lp_ctx;
+ if (creds_out != NULL) {
+ *creds_out = NULL;
+ }
+
if (schannel_global_required) {
status = schannel_check_required(&p->auth,
computer_name,
@@ -1258,7 +1262,7 @@ NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p,
{
NTSTATUS status = NT_STATUS_OK;
int i;
- struct netlogon_creds_CredentialState *creds;
+ struct netlogon_creds_CredentialState *creds = NULL;
DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
@@ -1271,9 +1275,14 @@ NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p,
unbecome_root();
if (!NT_STATUS_IS_OK(status)) {
+ const char *computer_name = "<unknown>";
+
+ if (creds != NULL && creds->computer_name != NULL) {
+ computer_name = creds->computer_name;
+ }
DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
"request from client %s machine account %s\n",
- r->in.computer_name, creds->computer_name));
+ r->in.computer_name, computer_name));
TALLOC_FREE(creds);
return status;
}
--
Samba Shared Repository
More information about the samba-cvs
mailing list