<div dir="ltr">Hi Mathieu<div><br></div><div>Thank you for this information. The LTS team will handle this. If nobody else step up I will do it myself.</div><div><br></div><div>For the LTS team: I will add this to the dla-needed.txt file later today but feel free to add that and claim yourself to this update.</div><div><br></div><div>Best regards</div><div><br></div><div>// Ola</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 23 March 2017 at 11:30, Mathieu Parent <span dir="ltr"><<a href="mailto:math.parent@gmail.com" target="_blank">math.parent@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
Today samba has released a security fix for a symlink race (leading to<br>
information disclosure).<br>
<br>
Salvatore will take care of the jessie upload, I have uploaded for<br>
sid, but we have not done anything on the wheezy side.<br>
<br>
See attached the backported patches for 3.6 (those are from the samba<br>
bugzilla which is still embargoed).<br>
<br>
Please take care of it.<br>
<br>
Thanks<br>
<br>
Mathieu Parent<br>
<br>
<br>
---------- Forwarded message ----------<br>
From: Karolin Seeger via samba-announce <<a href="mailto:samba-announce@lists.samba.org">samba-announce@lists.samba.<wbr>org</a>><br>
Date: 2017-03-23 10:11 GMT+01:00<br>
Subject: [Announce] Samba 4.6.1, 4.5.7 and 4.4.12 Security Releases<br>
Available for Download<br>
To: <a href="mailto:samba-announce@lists.samba.org">samba-announce@lists.samba.org</a><wbr>, <a href="mailto:samba@lists.samba.org">samba@lists.samba.org</a>,<br>
<a href="mailto:samba-technical@lists.samba.org">samba-technical@lists.samba.<wbr>org</a><br>
<br>
<br>
Release Announcements<br>
---------------------<br>
<br>
These are a security releases in order to address the following defect:<br>
<br>
o CVE-2017-2619 (Symlink race allows access outside share definition)<br>
<br>
=======<br>
Details<br>
=======<br>
<br>
o CVE-2017-2619:<br>
All versions of Samba prior to 4.6.1, 4.5.7, 4.4.11 are vulnerable to<br>
a malicious client using a symlink race to allow access to areas of<br>
the server file system not exported under the share definition.<br>
<br>
Samba uses the realpath() system call to ensure when a client requests<br>
access to a pathname that it is under the exported share path on the<br>
server file system.<br>
<br>
Clients that have write access to the exported part of the file system<br>
via SMB1 unix extensions or NFS to create symlinks can race the server<br>
by renaming a realpath() checked path and then creating a symlink. If<br>
the client wins the race it can cause the server to access the new<br>
symlink target after the exported share path check has been done. This<br>
new symlink target can point to anywhere on the server file system.<br>
<br>
This is a difficult race to win, but theoretically possible. Note that<br>
the proof of concept code supplied wins the race reliably only when<br>
the server is slowed down using the strace utility running on the<br>
server. Exploitation of this bug has not been seen in the wild.<br>
<br>
<br>
Changes:<br>
--------<br>
<br>
o Jeremy Allison <<a href="mailto:jra@samba.org">jra@samba.org</a>><br>
* BUG 12496: CVE-2017-2619: Symlink race permits opening files outside share<br>
directory.<br>
<br>
o Ralph Boehme <<a href="mailto:slow@samba.org">slow@samba.org</a>><br>
* BUG 12496: CVE-2017-2619: Symlink race permits opening files outside share<br>
directory.<br>
<br>
<br>
##############################<wbr>#########<br>
Reporting bugs & Development Discussion<br>
##############################<wbr>#########<br>
<br>
Please discuss this release on the samba-technical mailing list or by<br>
joining the #samba-technical IRC channel on <a href="http://irc.freenode.net" rel="noreferrer" target="_blank">irc.freenode.net</a>.<br>
<br>
If you do report problems then please try to send high quality<br>
feedback. If you don't provide vital information to help us track down<br>
the problem then you will probably be ignored. All bug reports should<br>
be filed under the "Samba 4.1 and newer" product in the project's Bugzilla<br>
database (<a href="https://bugzilla.samba.org/" rel="noreferrer" target="_blank">https://bugzilla.samba.org/</a>).<br>
<br>
<br>
==============================<wbr>==============================<wbr>==========<br>
== Our Code, Our Bugs, Our Responsibility.<br>
== The Samba Team<br>
==============================<wbr>==============================<wbr>==========<br>
<br>
<br>
<br>
================<br>
Download Details<br>
================<br>
<br>
The uncompressed tarballs and patch files have been signed<br>
using GnuPG (ID 6F33915B6568B7EA). The source code can be downloaded<br>
from:<br>
<br>
<a href="https://download.samba.org/pub/samba/stable/" rel="noreferrer" target="_blank">https://download.samba.org/<wbr>pub/samba/stable/</a><br>
<br>
The release notes are available online at:<br>
<br>
<a href="https://www.samba.org/samba/history/samba-4.6.1.html" rel="noreferrer" target="_blank">https://www.samba.org/samba/<wbr>history/samba-4.6.1.html</a><br>
<a href="https://www.samba.org/samba/history/samba-4.5.7.html" rel="noreferrer" target="_blank">https://www.samba.org/samba/<wbr>history/samba-4.5.7.html</a><br>
<a href="https://www.samba.org/samba/history/samba-4.4.12.html" rel="noreferrer" target="_blank">https://www.samba.org/samba/<wbr>history/samba-4.4.12.html</a><br>
<br>
Our Code, Our Bugs, Our Responsibility.<br>
(<a href="https://bugzilla.samba.org/" rel="noreferrer" target="_blank">https://bugzilla.samba.org/</a>)<br>
<br>
--Enjoy<br>
The Samba Team<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
--<br>
Mathieu<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div><font face="courier new, monospace" size="1"> --- Inguza Technology AB --- MSc in Information Technology ----</font></div><div><font face="courier new, monospace" size="1">/ <a href="mailto:ola@inguza.com" target="_blank">ola@inguza.com</a> Folkebogatan 26 \</font></div><div><font face="courier new, monospace" size="1">| <a href="mailto:opal@debian.org" target="_blank">opal@debian.org</a> 654 68 KARLSTAD |</font></div><div><font face="courier new, monospace" size="1">| <a href="http://inguza.com/" target="_blank">http://inguza.com/</a> Mobile: +46 (0)70-332 1551 |</font></div><div><font face="courier new, monospace" size="1">\ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 /</font></div><div><font face="courier new, monospace" size="1"> ---------------------------------------------------------------</font></div></div><div><br></div></div></div></div></div>
</div>