Hello dear stable release managers, We, samba maintainers, would like to propose two fixes for samba in lenny (that would be package version 2:3.2.4-4lenny1: * Fix account locking with an LDAP backend. Closes: #514151 * Correct du recursion in smbclient. Closes: #514703 The first bug is tagged "security" but went very late in the lenny release process and does not warrant a dedicated security upload. In short, the locking mechanism for accounts when samba a uses an LDAP server as account backend doesn't work and accounts are never locked, theoretically allowing brute force attacks. The security team ACK'ed our intent to fix this through s-p-u.... The latter bug is a clearly identified regression from samba 3.0.* series which was fixed in the latest 3.2.* samba version (3.2.8). It affects users who are doing backup and similar operations by using smbclient to access remote CIFS shares. Both patches are attached to this mail. --
Goal: Correct du recursion in smbclient
Fixes: #514703
Status wrt upstream: Fixed in 3.2.8
Author: Jeremy Allison <jra@samba.org>
Note: This patch was proposed by Jeremy Allison in the upstream bug report
(https://bugzilla.samba.org/show_bug.cgi?id=6021).
Index: samba-3.2.5/source/client/client.c
===================================================================
--- samba-3.2.5.orig/source/client/client.c
+++ samba-3.2.5/source/client/client.c
@@ -728,11 +728,11 @@
return;
}
p = strrchr_m(mask2,CLI_DIRSEP_CHAR);
- if (!p) {
- TALLOC_FREE(dir);
- return;
+ if (p) {
+ p[1] = 0;
+ } else {
+ mask2[0] = '\0';
}
- p[1] = 0;
mask2 = talloc_asprintf_append(mask2,
"%s%s*",
f->name,
Index: samba-3.2.5/source/libsmb/clidfs.c
===================================================================
--- samba-3.2.5.orig/source/libsmb/clidfs.c
+++ samba-3.2.5/source/libsmb/clidfs.c
@@ -306,10 +306,11 @@
}
if (p) {
- char *name = clean_name(NULL, p->mount);
+ char *name = clean_name(NULL, mnt);
if (!name) {
return;
}
+ TALLOC_FREE(p->mount);
p->mount = talloc_strdup(p, name);
TALLOC_FREE(name);
}
Goal: Account locking when LDAP backend is used.
Fixes: #514151
Status wrt upstream: Fixed in 3.2.6
Author: Jeremy Allison <jra@samba.org>
Note: This patch was propused by Jeremy Allison in the upstream bug report
(https://bugzilla.samba.org/show_bug.cgi?id=5825#c8). This only line
if fixed in 3.2.6 and looks like it solves the problem, even when #5825
(upstream report) is still pending.
Index: samba-3.2.5/source/passdb/pdb_interface.c
===================================================================
--- samba-3.2.5.orig/source/passdb/pdb_interface.c 2009-02-09 07:46:52.000000000 -0200
+++ samba-3.2.5/source/passdb/pdb_interface.c 2009-02-09 07:47:16.000000000 -0200
@@ -1150,7 +1150,9 @@
static NTSTATUS pdb_default_update_login_attempts (struct pdb_methods *methods, struct samu *newpwd, bool success)
{
- return NT_STATUS_NOT_IMPLEMENTED;
+ /* Only the pdb_nds backend implements this, by
+ * default just return ok. */
+ return NT_STATUS_OK;
}
static NTSTATUS pdb_default_get_account_policy(struct pdb_methods *methods, int policy_index, uint32 *value)
Attachment:
signature.asc
Description: Digital signature