Samba 4.6.10 has been released today (November 15), fixing a data corruption bug: https://www.samba.org/samba/history/samba-4.6.10.html We should update it (and probably at least tevent) for Mageia 6.
Whiteboard: (none) => MGA6TOO
Assigning to all packagers collectively, since the registered maintainer for this package seems unavailable. CC'ing neoclust who touched samba a lot.
Assignee: bugsquad => pkg-bugsCC: (none) => bgmilne, mageia, marja11
Samba 4.6.11 has been released on November 21, fixing two security issues: https://www.samba.org/samba/history/samba-4.6.11.html
Component: RPM Packages => SecurityQA Contact: (none) => securitySummary: samba 4.6.10 => samba new security issues CVE-2017-14746 and CVE-2017-15275
Assignee: pkg-bugs => lists.jjorgeCC: (none) => lists.jjorge
Upstream advisories for the two security issues: https://www.samba.org/samba/security/CVE-2017-14746.html https://www.samba.org/samba/security/CVE-2017-15275.html The second one also affects Mageia 5. We can handle the Mageia 6 update in this bug and Mageia 5 in Bug 21743.
Blocks: (none) => 21743Assignee: lists.jjorge => pkg-bugs
Version 4.7.3 with this security fixes pushed to cauldron.
Assignee: pkg-bugs => lists.jjorgeStatus: NEW => ASSIGNEDBlocks: 21743 => (none)
Blocks: (none) => 21743
Ouch it failed, then I see Nicolas has worked on it 3 days ago in cauldron, and that deps are not good. So I will only work in the MGA5 and MGA6 updates.
Blocks: 21743 => (none)Assignee: lists.jjorge => mageia
José, please stop removing the linkage between the two bugs. See Comment 3.
(In reply to David Walser from comment #6) > José, please stop removing the linkage between the two bugs. See Comment 3. Yes, sorry, I thought applying my comment would not change that. Update pushed to MGA6 testing. SRPMS : talloc-2.1.10-1.1.mga6 tevent-0.9.34-1.1.mga6 samba-4.6.11-1.mga6 RPMS list i586: libtalloc2-2.1.10-1.1.mga6.i586.rpm libtalloc-devel-2.1.10-1.1.mga6.i586.rpm python-talloc-2.1.10-1.1.mga6.i586.rpm libpytalloc-util2-2.1.10-1.1.mga6.i586.rpm libpytalloc-util-devel-2.1.10-1.1.mga6.i586.rpm talloc-debuginfo-2.1.10-1.1.mga6.i586.rpm libtevent0-0.9.34-1.1.mga6.i586.rpm libtevent-devel-0.9.34-1.1.mga6.i586.rpm python-tevent-0.9.34-1.1.mga6.i586.rpm tevent-debuginfo-0.9.34-1.1.mga6.i586.rpm samba-4.6.11-1.mga6.i586.rpm samba-client-4.6.11-1.mga6.i586.rpm samba-common-4.6.11-1.mga6.i586.rpm samba-dc-4.6.11-1.mga6.i586.rpm libsamba-dc0-4.6.11-1.mga6.i586.rpm libkdc-samba4_2-4.6.11-1.mga6.i586.rpm libsamba-devel-4.6.11-1.mga6.i586.rpm samba-krb5-printing-4.6.11-1.mga6.i586.rpm libsamba1-4.6.11-1.mga6.i586.rpm libsmbclient0-4.6.11-1.mga6.i586.rpm libsmbclient-devel-4.6.11-1.mga6.i586.rpm libwbclient0-4.6.11-1.mga6.i586.rpm libwbclient-devel-4.6.11-1.mga6.i586.rpm python-samba-4.6.11-1.mga6.i586.rpm samba-pidl-4.6.11-1.mga6.noarch.rpm samba-test-4.6.11-1.mga6.i586.rpm libsamba-test0-4.6.11-1.mga6.i586.rpm samba-winbind-4.6.11-1.mga6.i586.rpm samba-winbind-clients-4.6.11-1.mga6.i586.rpm samba-winbind-krb5-locator-4.6.11-1.mga6.i586.rpm samba-winbind-modules-4.6.11-1.mga6.i586.rpm ctdb-4.6.11-1.mga6.i586.rpm ctdb-tests-4.6.11-1.mga6.i586.rpm samba-debuginfo-4.6.11-1.mga6.i586.rpm x86_64 : lib64talloc2-2.1.10-1.1.mga6.x86_64.rpm lib64talloc-devel-2.1.10-1.1.mga6.x86_64.rpm python-talloc-2.1.10-1.1.mga6.x86_64.rpm lib64pytalloc-util2-2.1.10-1.1.mga6.x86_64.rpm lib64pytalloc-util-devel-2.1.10-1.1.mga6.x86_64.rpm talloc-debuginfo-2.1.10-1.1.mga6.x86_64.rpm lib64tevent0-0.9.34-1.1.mga6.x86_64.rpm lib64tevent-devel-0.9.34-1.1.mga6.x86_64.rpm python-tevent-0.9.34-1.1.mga6.x86_64.rpm tevent-debuginfo-0.9.34-1.1.mga6.x86_64.rpm samba-4.6.11-1.mga6.x86_64.rpm samba-client-4.6.11-1.mga6.x86_64.rpm samba-common-4.6.11-1.mga6.x86_64.rpm samba-dc-4.6.11-1.mga6.x86_64.rpm lib64samba-dc0-4.6.11-1.mga6.x86_64.rpm lib64kdc-samba4_2-4.6.11-1.mga6.x86_64.rpm lib64samba-devel-4.6.11-1.mga6.x86_64.rpm samba-krb5-printing-4.6.11-1.mga6.x86_64.rpm lib64samba1-4.6.11-1.mga6.x86_64.rpm lib64smbclient0-4.6.11-1.mga6.x86_64.rpm lib64smbclient-devel-4.6.11-1.mga6.x86_64.rpm lib64wbclient0-4.6.11-1.mga6.x86_64.rpm lib64wbclient-devel-4.6.11-1.mga6.x86_64.rpm python-samba-4.6.11-1.mga6.x86_64.rpm samba-pidl-4.6.11-1.mga6.noarch.rpm samba-test-4.6.11-1.mga6.x86_64.rpm lib64samba-test0-4.6.11-1.mga6.x86_64.rpm samba-winbind-4.6.11-1.mga6.x86_64.rpm samba-winbind-clients-4.6.11-1.mga6.x86_64.rpm samba-winbind-krb5-locator-4.6.11-1.mga6.x86_64.rpm samba-winbind-modules-4.6.11-1.mga6.x86_64.rpm ctdb-4.6.11-1.mga6.x86_64.rpm ctdb-tests-4.6.11-1.mga6.x86_64.rpm samba-debuginfo-4.6.11-1.mga6.x86_64.rpm
Thanks. Note that the talloc and tevent updates should *not* have had a subrel (and on top of that the subrel was put in the wrong place so it will be missed in the future). Ubuntu has issued an advisory for this on November 21: https://usn.ubuntu.com/usn/usn-3486-1/
Version: Cauldron => 6Whiteboard: MGA6TOO => (none)
Bugfix update to 4.6.12 committed in Mageia 6 SVN and submitted to the build system. It should be available later today: https://www.samba.org/samba/history/samba-4.6.12.html
Advisory: ======================== Updated samba packages fix security vulnerabilities: Stefan Metzmacher discovered that Samba incorrectly enforced SMB signing in certain situations. A remote attacker could use this issue to perform a man in the middle attack. (CVE-2017-12150) Stefan Metzmacher discovered that Samba incorrectly handled encryption across DFS redirects. A remote attacker could use this issue to perform a man in the middle attack. (CVE-2017-12151) Yihan Lian and Zhibin Hu discovered that Samba incorrectly handled memory when SMB1 is being used. A remote attacker could possibly use this issue to obtain server memory contents. (CVE-2017-12163) Yihan Lian and Zhibin Hu discovered that Samba incorrectly handled memory when processing certain SMB1 requests. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2017-14746) Volker Lendecke discovered that Samba incorrectly cleared memory when returning data to a client. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2017-15275) The samba package has been updated to version 4.6.12 to fix these issues and other bugs. Also, the talloc package has been updated to 2.1.10 and the tevent package has been updated to 0.9.34, as they were needed by the updated samba. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12150 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12151 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12163 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14746 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15275 https://www.samba.org/samba/security/CVE-2017-12150.html https://www.samba.org/samba/security/CVE-2017-12151.html https://www.samba.org/samba/security/CVE-2017-12163.html https://www.samba.org/samba/security/CVE-2017-14746.html https://www.samba.org/samba/security/CVE-2017-15275.html https://www.samba.org/samba/history/samba-4.6.8.html https://www.samba.org/samba/history/samba-4.6.9.html https://www.samba.org/samba/history/samba-4.6.10.html https://www.samba.org/samba/history/samba-4.6.11.html https://www.samba.org/samba/history/samba-4.6.12.html https://usn.ubuntu.com/usn/usn-3426-1/ https://usn.ubuntu.com/usn/usn-3486-1/ ======================== Updated packages in core/updates_testing: ======================== libtalloc2-2.1.10-1.1.mga6 libtalloc-devel-2.1.10-1.1.mga6 python-talloc-2.1.10-1.1.mga6 libpytalloc-util2-2.1.10-1.1.mga6 libpytalloc-util-devel-2.1.10-1.1.mga6 talloc-debuginfo-2.1.10-1.1.mga6 libtevent0-0.9.34-1.1.mga6 libtevent-devel-0.9.34-1.1.mga6 python-tevent-0.9.34-1.1.mga6 tevent-debuginfo-0.9.34-1.1.mga6 samba-4.6.12-1.mga6 samba-client-4.6.12-1.mga6 samba-common-4.6.12-1.mga6 samba-dc-4.6.12-1.mga6 libsamba-dc0-4.6.12-1.mga6 libkdc-samba4_2-4.6.12-1.mga6 libsamba-devel-4.6.12-1.mga6 samba-krb5-printing-4.6.12-1.mga6 libsamba1-4.6.12-1.mga6 libsmbclient0-4.6.12-1.mga6 libsmbclient-devel-4.6.12-1.mga6 libwbclient0-4.6.12-1.mga6 libwbclient-devel-4.6.12-1.mga6 python-samba-4.6.12-1.mga6 samba-pidl-4.6.12-1.mga6 samba-test-4.6.12-1.mga6 libsamba-test0-4.6.12-1.mga6 samba-winbind-4.6.12-1.mga6 samba-winbind-clients-4.6.12-1.mga6 samba-winbind-krb5-locator-4.6.12-1.mga6 samba-winbind-modules-4.6.12-1.mga6 ctdb-4.6.12-1.mga6 ctdb-tests-4.6.12-1.mga6 samba-debuginfo-4.6.12-1.mga6 from SRPMS: talloc-2.1.10-1.1.mga6.src.rpm tevent-0.9.34-1.1.mga6.src.rpm samba-4.6.12-1.mga6.src.rpm
Assignee: mageia => qa-bugs
on mga6-64 packages installed cleanly: - ctdb-4.6.12-1.mga6.x86_64 - ctdb-tests-4.6.12-1.mga6.x86_64 - lib64kdc-samba4_2-4.6.12-1.mga6.x86_64 - lib64pytalloc-util2-2.1.10-1.1.mga6.x86_64 - lib64samba-dc0-4.6.12-1.mga6.x86_64 - lib64samba-test0-4.6.12-1.mga6.x86_64 - lib64samba1-4.6.12-1.mga6.x86_64 - lib64smbclient0-4.6.12-1.mga6.x86_64 - lib64talloc2-2.1.10-1.1.mga6.x86_64 - lib64tevent0-0.9.34-1.1.mga6.x86_64 - lib64wbclient0-4.6.12-1.mga6.x86_64 - python-samba-4.6.12-1.mga6.x86_64 - python-tevent-0.9.34-1.1.mga6.x86_64 - python-talloc-2.1.10-1.1.mga6.x86_64 - samba-4.6.12-1.mga6.x86_64 - samba-client-4.6.12-1.mga6.x86_64 - samba-common-4.6.12-1.mga6.x86_64 - samba-dc-4.6.12-1.mga6.x86_64 - samba-krb5-printing-4.6.12-1.mga6.x86_64 - samba-test-4.6.12-1.mga6.x86_64 - samba-winbind-4.6.12-1.mga6.x86_64 - samba-winbind-clients-4.6.12-1.mga6.x86_64 - samba-winbind-krb5-locator-4.6.12-1.mga6.x86_64 - samba-winbind-modules-4.6.12-1.mga6.x86_64 smbtree lists available shares can access a share on this system from other mga6-systems and from a Win7 system From this system can access shares on other mga6 systems and on Win7 OK for mga6-64
Whiteboard: (none) => MGA6-64-OKCC: (none) => jim
on mga6-32 in a vbox VM Packages installed cleanly: samba-test-4.6.12-1.mga6.i586 samba-krb5-printing-4.6.12-1.mga6.i586 samba-winbind-krb5-locator-4.6.12-1.mga6.i586 samba-winbind-clients-4.6.12-1.mga6.i586 samba-dc-4.6.12-1.mga6.i586 python-samba-4.6.12-1.mga6.i586 samba-winbind-modules-4.6.12-1.mga6.i586 samba-winbind-4.6.12-1.mga6.i586 samba-client-4.6.12-1.mga6.i586 python-talloc-2.1.10-1.1.mga6.i586 libsamba-test0-4.6.12-1.mga6.i586 samba-4.6.12-1.mga6.i586 libsmbclient0-4.6.12-1.mga6.i586 libsamba1-4.6.12-1.mga6.i586 samba-common-4.6.12-1.mga6.i586 libwbclient0-4.6.12-1.mga6.i586 samba-pidl-4.6.12-1.mga6.noarch libtalloc2-2.1.10-1.1.mga6.i586 libsamba-dc0-4.6.12-1.mga6.i586 libpytalloc-util2-2.1.10-1.1.mga6.i586 libkdc-samba4_2-4.6.12-1.mga6.i586 ctdb-4.6.12-1.mga6.i586 ctdb-tests-4.6.12-1.mga6.i586 libtevent0-0.9.34-1.1.mga6.i586 python-tevent-0.9.34-1.1.mga6.i586 smbtree lists available shares from this system can access shares on other mga6 systems and on Win7 can access a share on this system from other mga6 systems and from Win7 OK for mga6-32
Whiteboard: MGA6-64-OK => MGA6-64-OK MGA6-32-OK
This update is now validated. The Advisory in comment#10 needs to be uploaded to SVN. The update can then be pushed to updates.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Advisory added.
Keywords: (none) => advisoryCC: (none) => tmb
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0023.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED