Fwd: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases
Is anyone up for grabbing this?
We should not be affected by these security issues, but I do not see any reasons why we should not update - just in case.
-Michael
Begin forwarded message:
From: Karolin Seeger via samba-announce samba-announce@lists.samba.org Subject: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases Date: 24 March 2021 at 12:02:14 GMT To: samba-announce@lists.samba.org, samba@lists.samba.org, samba-technical@lists.samba.org Reply-To: kseeger@samba.org
Release Announcements
These are security releases in order to address the following defects:
o CVE-2020-27840: Heap corruption via crafted DN strings. o CVE-2021-20277: Out of bounds read in AD DC LDAP server.
======= Details =======
o CVE-2020-27840: An anonymous attacker can crash the Samba AD DC LDAP server by sending easily crafted DNs as part of a bind request. More serious heap corruption is likely also possible.
o CVE-2021-20277: User-controlled LDAP filter strings against the AD DC LDAP server may crash the LDAP server.
For more details, please refer to the security advisories.
####################################### Reporting bugs & Development Discussion #######################################
Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/).
====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ======================================================================
================ Download Details ================
The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from:
https://download.samba.org/pub/samba/stable/The release notes are available online at:
https://www.samba.org/samba/history/samba-4.14.2.html https://www.samba.org/samba/history/samba-4.13.7.html https://www.samba.org/samba/history/samba-4.12.14.htmlOur Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/)
--Enjoy The Samba Team
Hi.
I will pick it up.
Adolf.
On 25/03/2021 10:41, Michael Tremer wrote:
Is anyone up for grabbing this?
We should not be affected by these security issues, but I do not see any reasons why we should not update - just in case.
-Michael
Begin forwarded message:
*From: *Karolin Seeger via samba-announce <samba-announce@lists.samba.org mailto:samba-announce@lists.samba.org> *Subject: **[Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases* *Date: *24 March 2021 at 12:02:14 GMT *To: *samba-announce@lists.samba.org mailto:samba-announce@lists.samba.org, samba@lists.samba.org mailto:samba@lists.samba.org, samba-technical@lists.samba.org mailto:samba-technical@lists.samba.org *Reply-To: *kseeger@samba.org mailto:kseeger@samba.org
Release Announcements
These are security releases in order to address the following defects:
o CVE-2020-27840: Heap corruption via crafted DN strings. o CVE-2021-20277: Out of bounds read in AD DC LDAP server.
======= Details =======
o CVE-2020-27840: An anonymous attacker can crash the Samba AD DC LDAP server by sending easily crafted DNs as part of a bind request. More serious heap corruption is likely also possible.
o CVE-2021-20277: User-controlled LDAP filter strings against the AD DC LDAP server may crash the LDAP server.
For more details, please refer to the security advisories.
####################################### Reporting bugs & Development Discussion #######################################
Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net http://irc.freenode.net.
If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/ https://bugzilla.samba.org/).
====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ======================================================================
================ Download Details ================
The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from:
https://download.samba.org/pub/samba/stable/ https://download.samba.org/pub/samba/stable/
The release notes are available online at:
https://www.samba.org/samba/history/samba-4.14.2.html https://www.samba.org/samba/history/samba-4.14.2.html https://www.samba.org/samba/history/samba-4.13.7.html https://www.samba.org/samba/history/samba-4.13.7.html https://www.samba.org/samba/history/samba-4.12.14.html https://www.samba.org/samba/history/samba-4.12.14.html
Our Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/ https://bugzilla.samba.org/)
--Enjoy The Samba Team
Great! Thank you.
On 25 Mar 2021, at 14:44, Adolf Belka adolf.belka@ipfire.org wrote:
Hi.
I will pick it up.
Adolf.
On 25/03/2021 10:41, Michael Tremer wrote:
Is anyone up for grabbing this?
We should not be affected by these security issues, but I do not see any reasons why we should not update - just in case.
-Michael
Begin forwarded message:
From: Karolin Seeger via samba-announce samba-announce@lists.samba.org Subject: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases Date: 24 March 2021 at 12:02:14 GMT To: samba-announce@lists.samba.org, samba@lists.samba.org, samba-technical@lists.samba.org Reply-To: kseeger@samba.org
Release Announcements
These are security releases in order to address the following defects:
o CVE-2020-27840: Heap corruption via crafted DN strings. o CVE-2021-20277: Out of bounds read in AD DC LDAP server.
======= Details =======
o CVE-2020-27840: An anonymous attacker can crash the Samba AD DC LDAP server by sending easily crafted DNs as part of a bind request. More serious heap corruption is likely also possible.
o CVE-2021-20277: User-controlled LDAP filter strings against the AD DC LDAP server may crash the LDAP server.
For more details, please refer to the security advisories.
####################################### Reporting bugs & Development Discussion #######################################
Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/).
====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ======================================================================
================ Download Details ================
The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from:
https://download.samba.org/pub/samba/stable/The release notes are available online at:
https://www.samba.org/samba/history/samba-4.14.2.html https://www.samba.org/samba/history/samba-4.13.7.html https://www.samba.org/samba/history/samba-4.12.14.htmlOur Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/)
--Enjoy The Samba Team-- Sent from my laptop
Hi Michael,
So the samba built with no problem but there was a change to the rootfile.
I have found that the rootfile is under separate directories for each architecture. I did a diff between the x86_64 and the armv5tel and most of the differences are just the x86_64 replaced by arm but I also found files where the filename itself is different between x86_64 and armv5tel with for instance ...gnu.so.2 replaced by ....gnueabi.so.2
So I can do the patch with the x86_64 rootfile updated as that architecture is what I am using for my builds. I don't know what to do with the others. Are those automatically updated based on mine or do I have to do something to get them updated and if so then what?
Regards, Adolf.
On 25/03/2021 18:50, Michael Tremer wrote:
Great! Thank you.
On 25 Mar 2021, at 14:44, Adolf Belka adolf.belka@ipfire.org wrote:
Hi.
I will pick it up.
Adolf.
On 25/03/2021 10:41, Michael Tremer wrote:
Is anyone up for grabbing this?
We should not be affected by these security issues, but I do not see any reasons why we should not update - just in case.
-Michael
Begin forwarded message:
From: Karolin Seeger via samba-announce samba-announce@lists.samba.org Subject: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases Date: 24 March 2021 at 12:02:14 GMT To: samba-announce@lists.samba.org, samba@lists.samba.org, samba-technical@lists.samba.org Reply-To: kseeger@samba.org
Release Announcements
These are security releases in order to address the following defects:
o CVE-2020-27840: Heap corruption via crafted DN strings. o CVE-2021-20277: Out of bounds read in AD DC LDAP server.
======= Details =======
o CVE-2020-27840: An anonymous attacker can crash the Samba AD DC LDAP server by sending easily crafted DNs as part of a bind request. More serious heap corruption is likely also possible.
o CVE-2021-20277: User-controlled LDAP filter strings against the AD DC LDAP server may crash the LDAP server.
For more details, please refer to the security advisories.
####################################### Reporting bugs & Development Discussion #######################################
Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/).
====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ======================================================================
================ Download Details ================
The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from:
https://download.samba.org/pub/samba/stable/The release notes are available online at:
https://www.samba.org/samba/history/samba-4.14.2.html https://www.samba.org/samba/history/samba-4.13.7.html https://www.samba.org/samba/history/samba-4.12.14.htmlOur Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/)
--Enjoy The Samba Team-- Sent from my laptop
Hello,
Sorry for all those late replies… I am working through my inbox going backwards :)
On 26 Mar 2021, at 14:18, Adolf Belka adolf.belka@ipfire.org wrote:
Hi Michael,
So the samba built with no problem but there was a change to the rootfile.
I have found that the rootfile is under separate directories for each architecture. I did a diff between the x86_64 and the armv5tel and most of the differences are just the x86_64 replaced by arm but I also found files where the filename itself is different between x86_64 and armv5tel with for instance ...gnu.so.2 replaced by ....gnueabi.so.2
Yes, this is quite annoying what they did there, but seems to be the current trend with everyone who builds their own build system.
So I can do the patch with the x86_64 rootfile updated as that architecture is what I am using for my builds. I don't know what to do with the others. Are those automatically updated based on mine or do I have to do something to get them updated and if so then what?
Just submit this as x86_64 and I will take care of the rest. I will either just merge it and pull the files from the nightly builders after the first build is done or build them manually on the appropriate architectures. Depending on what I find easier.
Best, -Michael
Regards, Adolf.
On 25/03/2021 18:50, Michael Tremer wrote:
Great! Thank you.
On 25 Mar 2021, at 14:44, Adolf Belka adolf.belka@ipfire.org wrote:
Hi.
I will pick it up.
Adolf.
On 25/03/2021 10:41, Michael Tremer wrote:
Is anyone up for grabbing this?
We should not be affected by these security issues, but I do not see any reasons why we should not update - just in case.
-Michael
Begin forwarded message:
From: Karolin Seeger via samba-announce samba-announce@lists.samba.org Subject: [Announce] Samba 4.14.2 (4.14.1), 4.13.7 (4.13.6) and 4.12.14 (4.12.13) Security Releases Date: 24 March 2021 at 12:02:14 GMT To: samba-announce@lists.samba.org, samba@lists.samba.org, samba-technical@lists.samba.org Reply-To: kseeger@samba.org
Release Announcements
These are security releases in order to address the following defects:
o CVE-2020-27840: Heap corruption via crafted DN strings. o CVE-2021-20277: Out of bounds read in AD DC LDAP server.
======= Details =======
o CVE-2020-27840: An anonymous attacker can crash the Samba AD DC LDAP server by sending easily crafted DNs as part of a bind request. More serious heap corruption is likely also possible.
o CVE-2021-20277: User-controlled LDAP filter strings against the AD DC LDAP server may crash the LDAP server.
For more details, please refer to the security advisories.
####################################### Reporting bugs & Development Discussion #######################################
Please discuss this release on the samba-technical mailing list or by joining the #samba-technical IRC channel on irc.freenode.net.
If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/).
====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ======================================================================
================ Download Details ================
The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from:
https://download.samba.org/pub/samba/stable/The release notes are available online at:
https://www.samba.org/samba/history/samba-4.14.2.html https://www.samba.org/samba/history/samba-4.13.7.html https://www.samba.org/samba/history/samba-4.12.14.htmlOur Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/)
--Enjoy The Samba Team-- Sent from my laptop
-
Adolf Belka -
Michael Tremer