1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml">
6 <title>Samba - Release Notes Archive</title>
11 <H2>Samba 4.2.7 Available for Download</H2>
15 =============================
16 Release Notes for Samba 4.2.7
18 =============================
21 This is a security release in order to address the following CVEs:
23 o CVE-2015-3223 (Denial of service in Samba Active Directory
25 o CVE-2015-5252 (Insufficient symlink verification in smbd)
26 o CVE-2015-5299 (Missing access control check in shadow copy
28 o CVE-2015-5296 (Samba client requesting encryption vulnerable
30 o CVE-2015-8467 (Denial of service attack against Windows
31 Active Directory server)
32 o CVE-2015-5330 (Remote memory read in Samba LDAP server)
34 Please note that if building against a system libldb, the required
35 version has been bumped to ldb-1.1.24. This is needed to ensure
36 we build against a system ldb library that contains the fixes
37 for CVE-2015-5330 and CVE-2015-3223.
44 All versions of Samba from 4.0.0 to 4.3.2 inclusive (resp. all
45 ldb versions up to 1.1.23 inclusive) are vulnerable to
46 a denial of service attack in the samba daemon LDAP server.
48 A malicious client can send packets that cause the LDAP server in the
49 samba daemon process to become unresponsive, preventing the server
50 from servicing any other requests.
52 This flaw is not exploitable beyond causing the code to loop expending
56 All versions of Samba from 3.0.0 to 4.3.2 inclusive are vulnerable to
57 a bug in symlink verification, which under certain circumstances could
58 allow client access to files outside the exported share path.
60 If a Samba share is configured with a path that shares a common path
61 prefix with another directory on the file system, the smbd daemon may
62 allow the client to follow a symlink pointing to a file or directory
63 in that other directory, even if the share parameter "wide links" is
64 set to "no" (the default).
67 All versions of Samba from 3.2.0 to 4.3.2 inclusive are vulnerable to
68 a missing access control check in the vfs_shadow_copy2 module. When
69 looking for the shadow copy directory under the share path the current
70 accessing user should have DIRECTORY_LIST access rights in order to
71 view the current snapshots.
73 This was not being checked in the affected versions of Samba.
76 Versions of Samba from 3.2.0 to 4.3.2 inclusive do not ensure that
77 signing is negotiated when creating an encrypted client connection to
80 Without this a man-in-the-middle attack could downgrade the connection
81 and connect using the supplied credentials as an unsigned, unencrypted
85 Samba, operating as an AD DC, is sometimes operated in a domain with a
86 mix of Samba and Windows Active Directory Domain Controllers.
88 All versions of Samba from 4.0.0 to 4.3.2 inclusive, when deployed as
89 an AD DC in the same domain with Windows DCs, could be used to
90 override the protection against the MS15-096 / CVE-2015-2535 security
93 Prior to MS16-096 it was possible to bypass the quota of machine
94 accounts a non-administrative user could create. Pure Samba domains
95 are not impacted, as Samba does not implement the
96 SeMachineAccountPrivilege functionality to allow non-administrator
97 users to create new computer objects.
100 All versions of Samba from 4.0.0 to 4.3.2 inclusive (resp. all
101 ldb versions up to 1.1.23 inclusive) are vulnerable to
102 a remote memory read attack in the samba daemon LDAP server.
104 A malicious client can send packets that cause the LDAP server in the
105 samba daemon process to return heap memory beyond the length of the
108 This memory may contain data that the client should not be allowed to
109 see, allowing compromise of the server.
111 The memory may either be returned to the client in an error string, or
112 stored in the database by a suitabily privileged user. If untrusted
113 users can create objects in your database, please confirm that all DN
114 and name attributes are reasonable.
120 o Andrew Bartlett <abartlet@samba.org>
121 * BUG 11552: CVE-2015-8467: samdb: Match MS15-096 behaviour for
124 o Jeremy Allison <jra@samba.org>
125 * BUG 11325: CVE-2015-3223: Fix LDAP \00 search expression attack DoS.
126 * BUG 11395: CVE-2015-5252: Fix insufficient symlink verification (file
127 access outside the share).
128 * BUG 11529: CVE-2015-5299: s3-shadow-copy2: Fix missing access check on
131 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
132 * BUG 11599: CVE-2015-5330: Fix remote read memory exploit in LDB.
134 o Stefan Metzmacher <metze@samba.org>
135 * BUG 11536: CVE-2015-5296: Add man in the middle protection when forcing
136 smb encryption on the client side.