Bug 12999

Summary:	samba new security issue CVE-2013-4496
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	davidwhodgins, geiger.david68210, sysadmin-bugs, tmb
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/590754/
Whiteboard:	MGA3TOO advisory mga4-64-ok mga4-32-ok mga3-32-ok mga3-64-ok
Source RPM:	samba-3.6.22-1.mga4.src.rpm	CVE:
Status comment:

Description David Walser 2014-03-12 12:45:53 CET

Upstream has issued an advisory on March 11:
http://www.samba.org/samba/security/CVE-2013-4496

The issue is fixed upstream in 3.6.23, 4.0.16, and 4.1.6.

Updated packages uploaded for Mageia 4 and Cauldron.

Patched package uploaded for Mageia 3.

Advisory:
========================

Updated samba packages fix security vulnerability:

In Samba before 3.6.23, the SAMR server neglects to ensure that attempted
password changes will update the bad password count, and does not set the
lockout flags.  This would allow a user unlimited attempts against the
password by simply calling ChangePasswordUser2 repeatedly.  This is
available without any other authentication (CVE-2013-4496).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4496
http://www.samba.org/samba/security/CVE-2013-4496
========================

Updated packages in core/updates_testing:
========================
samba-server-3.6.15-1.4.mga3
samba-client-3.6.15-1.4.mga3
samba-common-3.6.15-1.4.mga3
samba-doc-3.6.15-1.4.mga3
samba-swat-3.6.15-1.4.mga3
samba-winbind-3.6.15-1.4.mga3
nss_wins-3.6.15-1.4.mga3
libsmbclient0-3.6.15-1.4.mga3
libsmbclient0-devel-3.6.15-1.4.mga3
libsmbclient0-static-devel-3.6.15-1.4.mga3
libnetapi0-3.6.15-1.4.mga3
libnetapi-devel-3.6.15-1.4.mga3
libsmbsharemodes0-3.6.15-1.4.mga3
libsmbsharemodes-devel-3.6.15-1.4.mga3
libwbclient0-3.6.15-1.4.mga3
libwbclient-devel-3.6.15-1.4.mga3
samba-virusfilter-clamav-3.6.15-1.4.mga3
samba-virusfilter-fsecure-3.6.15-1.4.mga3
samba-virusfilter-sophos-3.6.15-1.4.mga3
samba-domainjoin-gui-3.6.15-1.4.mga3
samba-server-3.6.23-1.mga4
samba-client-3.6.23-1.mga4
samba-common-3.6.23-1.mga4
samba-doc-3.6.23-1.mga4
samba-swat-3.6.23-1.mga4
samba-winbind-3.6.23-1.mga4
nss_wins-3.6.23-1.mga4
libsmbclient0-3.6.23-1.mga4
libsmbclient0-devel-3.6.23-1.mga4
libsmbclient0-static-devel-3.6.23-1.mga4
libnetapi0-3.6.23-1.mga4
libnetapi-devel-3.6.23-1.mga4
libsmbsharemodes0-3.6.23-1.mga4
libsmbsharemodes-devel-3.6.23-1.mga4
libwbclient0-3.6.23-1.mga4
libwbclient-devel-3.6.23-1.mga4
samba-virusfilter-clamav-3.6.23-1.mga4
samba-virusfilter-fsecure-3.6.23-1.mga4
samba-virusfilter-sophos-3.6.23-1.mga4
samba-domainjoin-gui-3.6.23-1.mga4

from SRPMS:
samba-3.6.15-1.4.mga3.src.rpm
samba-3.6.23-1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:

David Walser 2014-03-12 12:45:59 CET

Whiteboard: (none) => MGA3TOO

David Walser 2014-03-13 21:47:06 CET

Severity: normal => major

David Walser 2014-03-14 19:29:00 CET

URL: (none) => http://lwn.net/Vulnerabilities/590754/

Comment 1 Dave Hodgins 2014-03-20 20:48:53 CET

No poc provided, so just need to test that samba is working. Advisory added
to svn.

CC: (none) => davidwhodgins
Whiteboard: MGA3TOO => MGA3TOO advisory

Comment 2 David GEIGER 2014-03-21 17:29:10 CET

Tested mga4_64,

Testing complete for samba-3.6.23-1.mga4, Ok for me nothing to report, seems work fine here.

samba-server-3.6.23-1.mga4
samba-client-3.6.23-1.mga4
samba-common-3.6.23-1.mga4
samba-doc-3.6.23-1.mga4
samba-swat-3.6.23-1.mga4
samba-winbind-3.6.23-1.mga4
libsmbclient0-3.6.23-1.mga4
libsmbsharemodes0-3.6.23-1.mga4
libwbclient0-3.6.23-1.mga4

CC: (none) => geiger.david68210
Whiteboard: MGA3TOO advisory => MGA3TOO advisory mga4-ok-64

David GEIGER 2014-03-21 17:29:58 CET

Whiteboard: MGA3TOO advisory mga4-ok-64 => MGA3TOO advisory mga4-64-ok

Comment 3 David GEIGER 2014-03-21 17:44:04 CET

Tested mga4_32,

Testing complete for samba-3.6.23-1.mga4, Ok for me nothing to report, seems work fine here too.

samba-server-3.6.23-1.mga4
samba-client-3.6.23-1.mga4
samba-common-3.6.23-1.mga4
samba-doc-3.6.23-1.mga4
samba-swat-3.6.23-1.mga4
samba-winbind-3.6.23-1.mga4
libsmbclient0-3.6.23-1.mga4
libsmbsharemodes0-3.6.23-1.mga4
libwbclient0-3.6.23-1.mga4

Whiteboard: MGA3TOO advisory mga4-64-ok => MGA3TOO advisory mga4-64-ok mga4-32-ok

Comment 4 David GEIGER 2014-03-21 19:28:12 CET

Tested mga3_32,

Testing complete for samba-3.6.15-1.4.mga3, Ok for me nothing to report, seems work fine here.

samba-server-3.6.15-1.4.mga3
samba-client-3.6.15-1.4.mga3
samba-common-3.6.15-1.4.mga3
samba-doc-3.6.15-1.4.mga3
samba-swat-3.6.15-1.4.mga3
samba-winbind-3.6.15-1.4.mga3
libsmbclient0-3.6.15-1.4.mga3
libsmbsharemodes0-3.6.15-1.4.mga3
libwbclient0-3.6.15-1.4.mga3

Whiteboard: MGA3TOO advisory mga4-64-ok mga4-32-ok => MGA3TOO advisory mga4-64-ok mga4-32-ok mga3-32-ok

Comment 5 David GEIGER 2014-03-21 19:32:36 CET

Tested mga3_64,

Testing complete for samba-3.6.15-1.4.mga3, Ok for me nothing to report, seems work fine here too.

samba-server-3.6.15-1.4.mga3
samba-client-3.6.15-1.4.mga3
samba-common-3.6.15-1.4.mga3
samba-doc-3.6.15-1.4.mga3
samba-swat-3.6.15-1.4.mga3
samba-winbind-3.6.15-1.4.mga3
libsmbclient0-3.6.15-1.4.mga3
libsmbsharemodes0-3.6.15-1.4.mga3
libwbclient0-3.6.15-1.4.mga3

Whiteboard: MGA3TOO advisory mga4-64-ok mga4-32-ok mga3-32-ok => MGA3TOO advisory mga4-64-ok mga4-32-ok mga3-32-ok mga3-64-ok

Comment 6 user7 2014-03-22 22:14:01 CET

Update validated. See comment 0 for advisory (was already uploaded to SVN). 

SRPMs:
samba-3.6.15-1.4.mga3.src.rpm
samba-3.6.23-1.mga4.src.rpm

Could sysadmin please push from core/updates_testing to core/updates for Mageia 3 & 4.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 7 Thomas Backlund 2014-03-23 10:22:12 CET

Update pushed:
http://advisories.mageia.org/MGASA-2014-0138.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED