Upstream has issued an advisory today (March 23): https://www.samba.org/samba/security/CVE-2017-2619.html
Ubuntu has issued an advisory for this today (March 23): https://www.ubuntu.com/usn/usn-3242-1/ They have a patch for 3.6.25.
RedHat has also said that they fixed CVE-2016-2126 for 3.6.x, when upstream's advisory says it only affects 4.0.0 and newer: https://rhn.redhat.com/errata/RHSA-2017-0662.html Should look to see if RedHat has a patch we're missing in RHEL6.
Assigning to the registered maintainer, but CC'ing all packagers collectively, in case the maintainer is unavailable.
CC: (none) => marja11, pkg-bugsAssignee: bugsquad => bgmilne
Note that samba has made new upstream releases to fix a regression from the initial CVE-2017-2619 fix, so we'll probably need another patch from Ubuntu.
Indeed, Ubuntu has issued a regression advisory on March 30: https://www.ubuntu.com/usn/usn-3242-2/
A new Samba Regression fix exists. in 4.x https://www.samba.org/samba/history/samba-4.6.3.html
CC: (none) => zombie_ryushu
Upstream has issued an advisory today (May 24): https://www.samba.org/samba/security/CVE-2017-7494.html RHEL6 has the patch(es) for this: https://rhn.redhat.com/errata/RHSA-2017-1270.html
Summary: samba new security issue CVE-2017-2619 => samba new security issues CVE-2017-2619 and CVE-2017-7494Severity: normal => critical
I have added the following in svn: Commit 1104446: CVE-2016-2126 Commit 1104449: CVE-2017-2619 as well as the fix for samba#12721 (regression in the initial patch) Commit 1104450: CVE-2017-7494 Currently building as committed locally ....
Status: NEW => ASSIGNED
Package built successfully, minimal testing done (it upgrades). samba-3.6.25-2.7.mga5 submitted and partially built. I won't have time to look at advisory text today.
Assignee: bgmilne => qa-bugsCC: (none) => bgmilne
Thanks Buchan! Advisory: ======================== Updated samba packages fix security vulnerabilities: A flaw was found in the way Samba handled PAC (Privilege Attribute Certificate) checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process (CVE-2016-2126). Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacker could use this issue to access files on the server outside of the exported directories (CVE-2017-2619). A remote code execution flaw was found in Samba. A malicious authenticated samba client, having write access to the samba share, could use this flaw to execute arbitrary code as root (CVE-2017-7494). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2126 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2619 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7494 https://www.samba.org/samba/security/CVE-2016-2126.html https://www.samba.org/samba/security/CVE-2017-2619.html https://www.samba.org/samba/security/CVE-2017-7494.html https://rhn.redhat.com/errata/RHSA-2017-0662.html https://www.ubuntu.com/usn/usn-3242-1/ https://www.ubuntu.com/usn/usn-3242-2/ https://rhn.redhat.com/errata/RHSA-2017-1270.html ======================== Updated packages in core/updates_testing: ======================== samba-server-3.6.25-2.7.mga5 samba-client-3.6.25-2.7.mga5 samba-common-3.6.25-2.7.mga5 samba-doc-3.6.25-2.7.mga5 samba-swat-3.6.25-2.7.mga5 samba-winbind-3.6.25-2.7.mga5 nss_wins-3.6.25-2.7.mga5 libsmbclient0-3.6.25-2.7.mga5 libsmbclient0-devel-3.6.25-2.7.mga5 libsmbclient0-static-devel-3.6.25-2.7.mga5 libnetapi0-3.6.25-2.7.mga5 libnetapi-devel-3.6.25-2.7.mga5 libsmbsharemodes0-3.6.25-2.7.mga5 libsmbsharemodes-devel-3.6.25-2.7.mga5 libwbclient0-3.6.25-2.7.mga5 libwbclient-devel-3.6.25-2.7.mga5 samba-virusfilter-clamav-3.6.25-2.7.mga5 samba-virusfilter-fsecure-3.6.25-2.7.mga5 samba-virusfilter-sophos-3.6.25-2.7.mga5 samba-domainjoin-gui-3.6.25-2.7.mga5 from samba-3.6.25-2.7.mga5.src.rpm
Before and after installing the update ... $ smbtree Enter dave's password: MGAGROUP \\X5V x5v \\X5V\dave Home Directories \\X5V\IPC$ IPC Service (x5v) \\X5V\homes Home Directories \\X5V\pdf-gen PDF Generator (only valid users) \\X5V\print$ \\I5V i5v \\I5V\dave Home Directories \\I5V\IPC$ IPC Service (i5v) \\I5V\homes Home Directories \\I5V\pdf-gen PDF Generator (only valid users) Working to access Mageia 5 i586 vb guest samba share from x86_64 vb guest and vice versa. Validating the update.
Whiteboard: (none) => MGA5-64-OK MGA5-32-OK advisoryKeywords: (none) => validated_updateCC: (none) => davidwhodgins, sysadmin-bugs
Missed an error message. Update failed to install. Unvalidating. Installation failed: file /usr/lib64/samba/vfs/svf-clamav.so from install of samba-server-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-virusfilter-clamav-3.6.25-2.6.mga5.x86_64 file /usr/lib64/samba/vfs/svf-sophos.so from install of samba-server-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-virusfilter-sophos-3.6.25-2.6.mga5.x86_64 file /usr/lib64/samba/vfs/svf-fsav.so from install of samba-server-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-virusfilter-fsecure-3.6.25-2.6.mga5.x86_64 file /usr/lib64/samba/vfs/svf-fsav.so from install of samba-virusfilter-fsecure-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-server-3.6.25-2.6.mga5.x86_64 file /usr/lib64/samba/vfs/svf-sophos.so from install of samba-virusfilter-sophos-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-server-3.6.25-2.6.mga5.x86_64 file /usr/lib64/samba/vfs/svf-clamav.so from install of samba-virusfilter-clamav-3.6.25-2.7.mga5.x86_64 conflicts with file from package samba-server-3.6.25-2.6.mga5.x86_64
Whiteboard: MGA5-64-OK MGA5-32-OK advisory => advisoryKeywords: validated_update => (none)
After discussing with David Walser on irc, decided to let this update through, as most people will not have the virus filters installed. I'll open a new bug for the conflicts. Testing complete after using urpmi --allow-force to install the update. Re-validating the update
Whiteboard: advisory => advisory MGA5-64-OK MGA5-32-OKKeywords: (none) => validated_update
bug 20928 opened for the file conflicts during updates.
As noted in #20928, there is a fix in svn commit 1104503 that would fix the conflicts after bumping subrel.
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0145.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED