- =================================
- Release Notes for Samba 3.4.0pre1
+ =============================
+ Release Notes for Samba 3.4.2
+ October 1, 2009
+ =============================
- =================================
+This is a security release in order to address CVE-2009-2813, CVE-2009-2948
+and CVE-2009-2906.
-This is the first preview release of Samba 3.4. This is *not*
-intended for production environments and is designed for testing
-purposes only. Please report any defects via the Samba bug reporting
-system at https://bugzilla.samba.org/.
+ o CVE-2009-2813:
+ In all versions of Samba later than 3.0.11, connecting to the home
+ share of a user will use the root of the filesystem
+ as the home directory if this user is misconfigured to have
+ an empty home directory in /etc/passwd.
+
+ o CVE-2009-2948:
+ If mount.cifs is installed as a setuid program, a user can pass it a
+ credential or password path to which he or she does not have access and
+ then use the --verbose option to view the first line of that file.
+ All known Samba versions are affected.
+
+ o CVE-2009-2906:
+ Specially crafted SMB requests on authenticated SMB connections can
+ send smbd into a 100% CPU loop, causing a DoS on the Samba server.
+
+
+######################################################################
+Changes
+#######
+
+Changes since 3.4.1
+-------------------
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 6763: Fix for CVE-2009-2813.
+ * BUG 6768: Fix for CVE-2009-2906.
+
+
+o Jeff Layton <jlayton@redhat.com>
+ * Fix for CVE-2009-2948.
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 3.4 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older versions follow:
+----------------------------------------
+
+ =============================
+ Release Notes for Samba 3.4.1
+ September 9, 2009
+ =============================
+
+
+This is the latest stable release of Samba 3.4.
+
+
+Major enhancements in Samba 3.4.1 include:
+
+ o Fix authentication on member servers without Winbind (bug #6650).
+ o Nautilus fails to copy files from an SMB share (bug #6649).
+ o Fix connections of Win98 clients (bug #6551).
+ o Fix interdomain trusts with Windows 2008 R2 DCs (bug #6697).
+ o Fix Winbind authentication issue (bug #6646).
+
+
+######################################################################
+Changes
+#######
+
+Changes since 3.4.0
+-------------------
+
+
+o Michael Adam <obnox@samba.org>
+ * BUG 6650: Fix authentication on member servers without Winbind.
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 6437: Make open_udp_socket() IPv6 clean.
+ * BUG 6506: Smbd server doesn't set EAs when a file is overwritten in
+ NT_TRANSACT_CREATE.
+ * BUG 6551: Fix connections of Win98 clients.
+ * BUG 6564: SetPrinter fails (panics) as non root.
+ * BUG 6593: Correctly implement SMB_INFO_STANDARD setfileinfo.
+ * BUG 6649: Nautilus fails to copy files from an SMB share.
+ * BUG 6651: Fix smbd SIGSEGV when breaking oplocks.
+ * BUG 6673: Fix 'smbpasswd' with "unix password sync = yes".
+
+
+o Yannick Bergeron <burgergold@hotmail.com>
+ * Increase the max_grp value to 128 (AIX NGROUPS_MAX value) instead of 32 to
+ allow AIX to call sys_getgrouplist only once.
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 6568: Fix _spoolss_GetPrintProcessorDirectory() implementation.
+ * BUG 6607: Fix crash bug in spoolss_addprinterex_level_2.
+ * BUG 6680: Fix authentication failure from Windows 7 when domain joined.
+ * BUG 6697: Fix interdomain trusts with Windows 2008 R2 DCs.
+
+
+o Olaf Flebbe <flebbe@nix.science-computing.de>
+ * BUG 6655: Fix 'smbcontrol smbd ping'.
+
+
+o Björn Jacke <bj@sernet.de>
+ * BUG 6105: Make linking of rpcclient --as-needed safe.
+
+
+o Matt Kraai <mkraai@beckman.com>
+ * BUG 6630: Fix opening of sockets on QNX.
+
+
+o Robert LeBlanc <robert@leblancnet.us>
+ * BUG 6700: Use dns domain name when needing to guess server principal.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 5886: Fix password change propagation with ldapsam.
+ * BUG 6585: Fix unqualified "net join".
+ * BUG 6611: Fix a valgrind error in chain_reply.
+ * BUG 6646: Fix Winbind authentication issue.
+ * Fix linking on Solaris.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 6222: Default to DRSUAPI replication for net rpc vampire keytab.
+ * BUG 6532: Fix the build with external talloc.
+ * BUG 6538: Cancel all locks that are made before the first failure.
+ * BUG 6627: Raise the timeout for lsa_Lookup*() calls from 10 to 35 seconds.
+ * BUG 6651: Fix smbd SIGSEGV when breaking oplocks.
+ * BUG 6664: Fix truncation of the session key.
+
+
+o Tim Prouty <tprouty@samba.org>
+ * BUG 6620: Fix a bug in renames of directories.
+
+
+o Rusty Russell <rusty@rustcorp.com.au>
+ * BUG 6601: Avoid global fd limits.
+
+
+o SATOH Fumiyasu <fumiyas@osstech.co.jp>
+ * BUG 6496: MS-DFS cannot follow multibyte char link name in libsmbclient.
+
+
+o Simo Sorce <idra@samba.org>
+ * BUG 6693: Check we read off the complete event from inotify.
+
+
+o Peter Volkov <pva@gentoo.org>
+ * BUG 6105: Make linking of cifs.upcall --as-needed safe.
+
+
+o TAKEDA Yasuma <yasuma@osstech.co.jp>
+ * BUG 5879: Update LDAP schema for Netscape DS 5.
+
+
+o Bo Yang <boyang@samba.org>
+ * BUG 6560: Fix lookupname.
+ * BUG 6615: Fix browsing of DFS when using kerberos in libsmbclient.
+ * BUG 6688: Fix crash in 'net usershare list'.
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 3.4 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+----------------------------------------------------------------------
+
+ =============================
+ Release Notes for Samba 3.4.0
+ July 3, 2009
+ =============================
+
+
+This is the first stable release of Samba 3.4.
Major enhancements in Samba 3.4.0 include:
------------------------------------------
+Configuration changes:
+o The default passdb backend has been changed to 'tdbsam'!
+
General changes:
o Samba4 and Samba3 sources are included in the tarball
Authentication Changes:
o Changed the way smbd handles untrusted domain names given during user
- authentication
+ authentication.
+
+Printing Changes:
+o Various fixes including printer change notificiation for Samba spoolss
+ print servers.
Internal changes:
-o The spoolss subsystem has been converted to IDL.
+o The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog
+ and spoolss) were replaced by autogenerated code based on PIDL.
+o Samba3 and Samba4 do now share a common tevent library.
+o The code has been cleaned up and the major basic interfaces are shared with
+ Samba4 now.
+o An asynchronous API has been added.
+
+
+Configuration changes
+=====================
+
+!!! ATTENTION !!!
+The default passdb backend has been changed to 'tdbsam'! That breaks existing
+setups using the 'smbpasswd' backend without explicit declaration! Please use
+'passdb backend = smbpasswd' if you would like to stick to the 'smbpasswd'
+backend or convert your smbpasswd entries using e.g. 'pdbedit -i smbpasswd -e
+tdbsam'.
+
+The 'tdbsam' backend is much more flexible concerning per user settings
+like 'profile path' or 'home directory' and there are some commands which do not
+work with the 'smbpasswd' backend at all.
General Changes
behavior.
+Printing Changes
+================
+
+The spoolss subsystem was replaced by autogenerated code based on PIDL. That fixes
+several printing issues including printer change notificiation on Samba print
+servers and will stabilize the printing functionality generally.
+The support for spoolss printing with Windows Vista has been improved.
+
+
Internal Changes
================
-The spoolss subsystem has been converted to IDL. So Günther Deschner finally
-corrected one of the biggest mistakes in the development of Samba:
-Hand-marshalled RPC stubs.
+The remaining hand-marshalled DCE/RPC services (ntsvcs, svcctl, eventlog and
+spoolss) were replaced by autogenerated code based on PIDL.
+So Günther Deschner finally corrected one of the biggest mistakes in the
+development of Samba: Hand-marshalled RPC stubs.
Thanks a lot! :-)
+Samba3 and Samba4 do now share a common tevent library for fd and timer events.
+
+The code has been cleaned up and Samba3 and Samba4 do share the major basic
+interfaces now. That is why the libraries were moved to the toplevel directory.
+That is one of the first steps to share code and minimize the gap between
+these two versions.
+
+An asynchronous API has been added.
+
+
+######################################################################
+Changes
+#######
+
+smb.conf changes
+----------------
+
+ Parameter Name Description Default
+ -------------- ----------- -------
+
+ access based share enum New No
+ dedicated keytab file New ""
+ kerberos method New default
+ map untrusted to domain New No
+ max open files Changed Default auto detected
+ passdb backend Changed Default tdbsam
+ perfcount module New ""
+ use kerberos keytab Removed
+
+
+New [sub]commands
+-----------------
+
+ net eventlog Import/dump/export native win32 eventlog files.
+ net rpc service create Create a new service.
+ net rpc service delete Delete an existing service.
+
+
+New configure options
+---------------------
+
+--enable-external-libtalloc Enable external talloc
+--enable-merged-build Build Samba 4 as well
+--enable-gnutls Turn on gnutls support
+--with-statedir=DIR Where to put persistent state files
+--with-cachedir=DIR Where to put temporary cache files
+--with-ncalprcdir=DIR Where to put ncalrpc sockets
+--with-selftest-shrdir=DIR The share directory that make test will be run
+ against
+--with-selftest-custom-conf=PATH
+ An optional custom smb.conf that is included in
+ the server smb.conf during make test
+--with-wbclient Use external wbclient
+--with-included-popt Use bundled popt library, not from system
+--with-libiconv=BASEDIR Use libiconv in BASEDIR/lib and BASEDIR/include
+--with-sqlite3 SQLITE3 backend support
+--with-pthreads Include pthreads
+--with-setproctitle Search for setproctitle support
+
+
+Commit Highlights
+=================
+
+
+o Steven Danneman <steven.danneman@isilon.com>
+ * Change the way smbd handles untrusted domain names given during user
+ authentication.
+
+
+o Guenther Deschner <gd@samba.org>
+ * Replace the hand-marshalled DCE/RPC services ntsvcs, svcctl, eventlog
+ and spoolss by autogenerated code based on PIDL.
+ * Fix several printing issues and improve support for printer change
+ notificiations.
+ * Add 'net eventlog'.
+
+
+o Volker Lendecke <vl@samba.org>
+ * Add asynchronous API.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * Make Samba3 and Samba4 share a tevent library.
+
+
+o Dan Sledz <dsledz@isilon.com>
+ * Add two new parameters to control how we verify kerberos tickets.
+
+
+o Danny Tylman <danny.tylman@insightix.com>
+ * Add 'net rpc service' subcommands 'create' and 'delete'.
+
+
+o Jelmer Vernooij <jelmer@samba.org>
+ * Make merged build possible.
+ * Move common libraries to the shared lib/ directory.
+
+
+Changes since 3.4.0rc1
+----------------------
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 6520: Fix time stamps when "unix extensions = yes".
+
+
+o Michael Adam <obnox@samba.org>
+ * BUG 6509: Use gid (not uid) cache in fetch_gid_from_cache().
+ * BUG 6521: Fix building tevent_ntstatus without config.h.
+ * BUG 6531: Fix pid file name.
+
+
+o Guenther Deschner <gd@samba.org>
+ * BUG 6512: Fix support for enumerating user forms.
+
+
+o Bjoern Jacke <bj@sernet.de>
+ * BUG 6497: Fix calling of 'test' in configure.
+ * BUG 6459: Fix build of pam_smbpass on some distributions.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 6431: Local groups from 3.0 setups no longer found.
+ * BUG 6498: Add workaround for MS KB932762.
+
+
+o David Markey <admin@dmarkey.com>
+ * BUG 6514: Improve error message in 'net' when smb.conf is not available.
+
+
+o Jim McDonough <jmcd@samba.org>
+ * BUG 6481: 'net ads leave' needs to try account deletion, NetUnjoinDomain
+ not.
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 6526: Fix notifies in the share root directory.
+
+
+o Bo Yang <boyang@samba.org>
+ * BUG 6499: Fix building of pam_smbpass.
+
+
+Changes since 3.4.0pre2
+-----------------------
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 6297: Owner of sticky directory cannot delete files created by
+ others.
+ * BUG 6476: Fix smbd-zombies in memory when using [x]inetd.
+ * BUG 6487: Add missing DFS call in trans2 mkdir call.
+ * BUG 6488: acl_group_override() call in posix acls references an
+ uninitialized variable.
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 4296: Clean up group membership while deleting a user.
+ * BUG 5456: Fix "net ads testjoin".
+ * BUG 6253: Use correct value for password expiry calculation in
+ pam_winbind.
+ * BUG 6305: Correctly prompt for a password when a username was given.
+ * BUG 6451: net/libnetapi user rename using wrong access bits.
+ * BUG 6458: Fix uninitialized variable in local_password_change().
+ * BUG 6465: Fix enumeration of empty aliases.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 4699: Remove pidfile on clean shutdown.
+ * BUG 6349: Initialize domain info struct.
+ * BUG 6449: 'net rap user add' crashes without -C option.
+
+
+o David Markey <admin@dmarkey.com>
+ * BUG 6328: Add support for multiple rights to
+ "net sam rights grant/revoke".
+
+
+o Andreas Schneider <mail@cynapses.org>
+ * Improve pam_winbind documentation.
+
+
+o Simo Sorce <idra@samba.org>
+ * BUG 6081: Make it possible to change machine account sids.
+ * BUG 6333: Consolidate create/delete account paths in pdbedit.
+ * BUG 6584: Allow DOM\user when changing passwords remotely.
+
+
+o Jelmer Vernooij <jelmer@samba.org>
+ * Remove outdated Debian package sources.
+
+
+Changes since 3.4.0pre1
+-----------------------
+
+
+o Jeremy Allison <jra@samba.org>
+ * BUG 6291: Fix 'force user'.
+ * BUG 6313: ldapsam_update_sam_account() crashes while doing talloc_free on
+ malloced memory.
+ * BUG 6315: Fix smbd crashes when doing vfs_full_audit on IPC$ close event.
+ * BUG 6330: Fix DFS on AIX.
+ * Fix a bunch of compiler warnings about wrong format types.
+ * Fix the core of the SAMR access functions.
+ * Fix SAMR server for winbindd access.
+
+
+o Michael Adam <obnox@samba.org>
+ * BUG 4271: testparm should not print includes.
+ * BUG 6292: Update config.guess from gnu.org.
+ * BUG 6320: Handle registry config source in file_list.
+ * BUG 6371: Unsuccessful 'net conf setparm' leaves empty share.
+ * BUG 6387: Fix a crash bug in idmap_ldap_unixids_to_sids.
+ * BUG 6415: Filter out of range mappings in default idmap config
+ (idmap_tdb).
+ * BUG 6416: Filter out of range mappings in default idmap config
+ (idmap_tdb2).
+ * BUG 6417: Filter out of range mappings in default idmap config
+ (idmap_ldap).
+ * Add dbwrap_tool - a tdb tool that is CTDB-aware.
+ * Hide "config backend" from swat.
+ * Fix linking with --disable-shared-libs.
+
+
+o Steven Danneman <steven.danneman@isilon.com>
+ * Fix issue with missing entries when enumerating directories.
+ * Map NULL domains to our global sam name.
+
+
+o Günther Deschner <gd@samba.org>
+ * BUG 5859: Fix renaming of samr objects failed due to samr setuserinfo
+ access checks.
+ * BUG 6099: Fix NETLOGON credential chain.
+ * BUG 6253: Use correct value for password expiry calculation.
+ * BUG 6309: Support remote unjoining of Windows 2003 or greater.
+ * BUG 6340: Don't segfault when cleartext trustdom pwd could not be
+ retrieved.
+ * BUG 6372: usermanager only displaying 1024 groups and aliases.
+ * Fix driver upload for Xerox 4110 PS printer driver.
+ * Add "net dom renamecomputer" to rename machines in a domain.
+ * Inspect the correct computername string before enabling/disabling the
+ change button in netdomjoin-gui.
+ * Fix join prompt dialog test in netdomjoin-gui.
+ * Only gray out labels when not root and not connecting to remote
+ machines (netdomjoin-gui).
+ * Allow to switch between workgroups/domains with the same name
+ (netdomjoin-gui).
+ * Add NetShutdownInit and NetShutdownAbort.
+ * Fix samr access checks.
+ * Add a security model to LSA.
+ * Fix nss_wrapper build for Solaris.
+
+
+o Geza Gemes <geza@kzsdabas.hu>
+ * BUG 6136: New AFS syscall conventions.
+
+
+o Ole Hansen <ole@redvw.com>
+ * BUG 6359: smbclient -L does not list workgroup for hosts with both IPv4
+ and IPv6 addresses
+
+
+o Björn Jacke <bj@sernet.de>
+ * Also handle DirX return codes.
+
+
+o Steve Langasek <vorlon@debian.org>
+ * BUG 4831: Don't call openlog() or closelog() from pam_smbpass.
+
+
+o Volker Lendecke <vl@samba.org>
+ * BUG 5681: Do not limit the number of network interfaces.
+ * BUG 6157: Fix handling of multi-value attribute "uid".
+ * BUG 6302: Give the VFS a chance to read from 0-byte files.
+ * BUG 6336: Fix segfault in 'net groupmap set'.
+ * BUG 6361: Make --rcfile work in smbget.
+ * Do not crash in ctdbd_traverse if ctdbd is not around.
+ * Fix Coverity ID 897.
+ * Fix a race condition in vfs_aio_fork with gpfs share modes.
+ * Fix bug disclosed by lock8 torture test.
+ * Fix a race condition in winbind leading to a panic.
+ * Attempt to fix a Debian build problem.
+
+
+o Jim McDonough <jmcd@samba.org>
+ * Detect tight loop in tdb_find().
+
+
+o Stefan Metzmacher <metze@samba.org>
+ * BUG 2346: Fix posix ACLs when setting an ACL without explicit ACE for the
+ owner.
+
+
+o Tim Prouty <tprouty@samba.org>
+ * Fix chained sesssetupAndX/tconn messages.
+ * Fix strict locking with chained reads.
+ * Fix two bugs in sendfile.
+
+
+o Slava Semushin <php-coder@altlinux.ru>
+ * Fix memory leak.
+ * Fix file descriptor leak.
+
+
+o Aravind Srinivasan <aravind.srinivasan@isilon.com>
+ * Fallback to the legacy sid_to_(uid|gid) instead of returning NULL.
+ * Always allocate memory in dptr_ReadDirName.
+
+
+o Kumar Thangavelu <Kumar.Thangavelu@riverbed.com>
+ * Fix 'net' crash during domain join.
+
+
+o Marc VanHeyningen <marc.vanheyningen@isilon.com>
+ * Zero an uninitialized array.
+ * Allow child processes to exit gracefully if we are out of fds.
+
######################################################################
Reporting bugs & Development Discussion
git.samba.org / obnox / samba-ctdb.git / blobdiff