Bug 12999 - samba new security issue CVE-2013-4496
Summary: samba new security issue CVE-2013-4496
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/590754/
Whiteboard: MGA3TOO advisory mga4-64-ok mga4-32-o...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-03-12 12:45 CET by David Walser
Modified: 2014-03-23 10:22 CET (History)
4 users (show)

See Also:
Source RPM: samba-3.6.22-1.mga4.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2014-03-12 12:45:53 CET 
Upstream has issued an advisory on March 11:
http://www.samba.org/samba/security/CVE-2013-4496

The issue is fixed upstream in 3.6.23, 4.0.16, and 4.1.6.

Updated packages uploaded for Mageia 4 and Cauldron.

Patched package uploaded for Mageia 3.

Advisory:
========================

Updated samba packages fix security vulnerability:

In Samba before 3.6.23, the SAMR server neglects to ensure that attempted
password changes will update the bad password count, and does not set the
lockout flags.  This would allow a user unlimited attempts against the
password by simply calling ChangePasswordUser2 repeatedly.  This is
available without any other authentication (CVE-2013-4496).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4496
http://www.samba.org/samba/security/CVE-2013-4496
========================

Updated packages in core/updates_testing:
========================
samba-server-3.6.15-1.4.mga3
samba-client-3.6.15-1.4.mga3
samba-common-3.6.15-1.4.mga3
samba-doc-3.6.15-1.4.mga3
samba-swat-3.6.15-1.4.mga3
samba-winbind-3.6.15-1.4.mga3
nss_wins-3.6.15-1.4.mga3
libsmbclient0-3.6.15-1.4.mga3
libsmbclient0-devel-3.6.15-1.4.mga3
libsmbclient0-static-devel-3.6.15-1.4.mga3
libnetapi0-3.6.15-1.4.mga3
libnetapi-devel-3.6.15-1.4.mga3
libsmbsharemodes0-3.6.15-1.4.mga3
libsmbsharemodes-devel-3.6.15-1.4.mga3
libwbclient0-3.6.15-1.4.mga3
libwbclient-devel-3.6.15-1.4.mga3
samba-virusfilter-clamav-3.6.15-1.4.mga3
samba-virusfilter-fsecure-3.6.15-1.4.mga3
samba-virusfilter-sophos-3.6.15-1.4.mga3
samba-domainjoin-gui-3.6.15-1.4.mga3
samba-server-3.6.23-1.mga4
samba-client-3.6.23-1.mga4
samba-common-3.6.23-1.mga4
samba-doc-3.6.23-1.mga4
samba-swat-3.6.23-1.mga4
samba-winbind-3.6.23-1.mga4
nss_wins-3.6.23-1.mga4
libsmbclient0-3.6.23-1.mga4
libsmbclient0-devel-3.6.23-1.mga4
libsmbclient0-static-devel-3.6.23-1.mga4
libnetapi0-3.6.23-1.mga4
libnetapi-devel-3.6.23-1.mga4
libsmbsharemodes0-3.6.23-1.mga4
libsmbsharemodes-devel-3.6.23-1.mga4
libwbclient0-3.6.23-1.mga4
libwbclient-devel-3.6.23-1.mga4
samba-virusfilter-clamav-3.6.23-1.mga4
samba-virusfilter-fsecure-3.6.23-1.mga4
samba-virusfilter-sophos-3.6.23-1.mga4
samba-domainjoin-gui-3.6.23-1.mga4

from SRPMS:
samba-3.6.15-1.4.mga3.src.rpm
samba-3.6.23-1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
David Walser 2014-03-12 12:45:59 CET

Whiteboard: (none) => MGA3TOO

David Walser 2014-03-13 21:47:06 CET

Severity: normal => major

David Walser 2014-03-14 19:29:00 CET

URL: (none) => http://lwn.net/Vulnerabilities/590754/

Comment 1 Dave Hodgins 2014-03-20 20:48:53 CET 
No poc provided, so just need to test that samba is working. Advisory added
to svn.

CC: (none) => davidwhodgins
Whiteboard: MGA3TOO => MGA3TOO advisory

Comment 2 David GEIGER 2014-03-21 17:29:10 CET 
Tested mga4_64,

Testing complete for samba-3.6.23-1.mga4, Ok for me nothing to report, seems work fine here.

samba-server-3.6.23-1.mga4
samba-client-3.6.23-1.mga4
samba-common-3.6.23-1.mga4
samba-doc-3.6.23-1.mga4
samba-swat-3.6.23-1.mga4
samba-winbind-3.6.23-1.mga4
libsmbclient0-3.6.23-1.mga4
libsmbsharemodes0-3.6.23-1.mga4
libwbclient0-3.6.23-1.mga4

CC: (none) => geiger.david68210
Whiteboard: MGA3TOO advisory => MGA3TOO advisory mga4-ok-64

David GEIGER 2014-03-21 17:29:58 CET

Whiteboard: MGA3TOO advisory mga4-ok-64 => MGA3TOO advisory mga4-64-ok

Comment 3 David GEIGER 2014-03-21 17:44:04 CET 
Tested mga4_32,

Testing complete for samba-3.6.23-1.mga4, Ok for me nothing to report, seems work fine here too.

samba-server-3.6.23-1.mga4
samba-client-3.6.23-1.mga4
samba-common-3.6.23-1.mga4
samba-doc-3.6.23-1.mga4
samba-swat-3.6.23-1.mga4
samba-winbind-3.6.23-1.mga4
libsmbclient0-3.6.23-1.mga4
libsmbsharemodes0-3.6.23-1.mga4
libwbclient0-3.6.23-1.mga4

Whiteboard: MGA3TOO advisory mga4-64-ok => MGA3TOO advisory mga4-64-ok mga4-32-ok

Comment 4 David GEIGER 2014-03-21 19:28:12 CET 
Tested mga3_32,

Testing complete for samba-3.6.15-1.4.mga3, Ok for me nothing to report, seems work fine here.

samba-server-3.6.15-1.4.mga3
samba-client-3.6.15-1.4.mga3
samba-common-3.6.15-1.4.mga3
samba-doc-3.6.15-1.4.mga3
samba-swat-3.6.15-1.4.mga3
samba-winbind-3.6.15-1.4.mga3
libsmbclient0-3.6.15-1.4.mga3
libsmbsharemodes0-3.6.15-1.4.mga3
libwbclient0-3.6.15-1.4.mga3

Whiteboard: MGA3TOO advisory mga4-64-ok mga4-32-ok => MGA3TOO advisory mga4-64-ok mga4-32-ok mga3-32-ok

Comment 5 David GEIGER 2014-03-21 19:32:36 CET 
Tested mga3_64,

Testing complete for samba-3.6.15-1.4.mga3, Ok for me nothing to report, seems work fine here too.

samba-server-3.6.15-1.4.mga3
samba-client-3.6.15-1.4.mga3
samba-common-3.6.15-1.4.mga3
samba-doc-3.6.15-1.4.mga3
samba-swat-3.6.15-1.4.mga3
samba-winbind-3.6.15-1.4.mga3
libsmbclient0-3.6.15-1.4.mga3
libsmbsharemodes0-3.6.15-1.4.mga3
libwbclient0-3.6.15-1.4.mga3

Whiteboard: MGA3TOO advisory mga4-64-ok mga4-32-ok mga3-32-ok => MGA3TOO advisory mga4-64-ok mga4-32-ok mga3-32-ok mga3-64-ok

Comment 6 user7 2014-03-22 22:14:01 CET 
Update validated. See comment 0 for advisory (was already uploaded to SVN). 

SRPMs:
samba-3.6.15-1.4.mga3.src.rpm
samba-3.6.23-1.mga4.src.rpm

Could sysadmin please push from core/updates_testing to core/updates for Mageia 3 & 4.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 7 Thomas Backlund 2014-03-23 10:22:12 CET 
Update pushed:
http://advisories.mageia.org/MGASA-2014-0138.html

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.