[REGRESSION] sever signing = default (false) for smbd (with CVE-2016-2115)

[Michael Adam]

On 2016-04-14 at 08:42 +0200, Michael Adam wrote:
> On 2016-04-14 at 08:35 +0200, Andreas Schneider wrote:
> > Hello,
> > 
> > at least in Samba 3.6 we have 'server signing = false' as the default case. 
> > With CVE-2016-2115 we have 'client ipc signing = required'. This means that 
> > Samba clients which try a RPC connection to a PDC will fail because the server 
> > doesn't support signing!
> > 
> > Shouldn't we set 'server singing = auto' as the default for all Samba versions 
> > now?
> 
> Agreed.
> 
> I guess the attached (untested) patch should implement this.

Forget this patch, please!

As metze wrote, only 3.6 and older seem to be affected.
In current versions, the 'disabled' is not effectively
disabled. The patches for 2114 together with some preparatory
patches around a56c35a4deec9745ff27a66ddc85db48c5dfaf97
effectively turn 'disabled' into 'enabled, but only announce
if configured'. Hence if the client requires it, it works,
even if disabled by config...

We need to complete the backport to 3.6...

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20160414/909a17b1/signature.sig>