CVE-2015-0240

Updated samba packages fix security vulnerabilities:

An uninitialized pointer use flaw was found in the Samba daemon (smbd). A malicious Samba client could send specially crafted netlogon packets that, when processed by smbd, could potentially lead to arbitrary code execution with the privileges of the user running smbd (by default, the root user) (CVE-2015-0240).

These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

samba was updated to fix one security issue.

This security issue was fixed:

• CVE-2015-0240: Don't call talloc_free on an uninitialized pointer (bnc#917376).

These non-security issues were fixed:

• Fix vfs_snapper DBus string handling (bso#11055, bnc#913238).
• Fix libsmbclient DFS referral handling.
  • Reuse connections derived from DFS referrals (bso#10123).
  • Set domain/workgroup based on authentication callback value (bso#11059).
• pam_winbind: Fix warn_pwd_expire implementation (bso#9056).
• nsswitch: Fix soname of linux nss_*.so.2 modules (bso#9299).
• Fix profiles tool (bso#9629).
• s3-lib: Do not require a password with --use-ccache (bso#10279).
• s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control (bso#10949).
• s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses (bso#10952).
• s3:smb2_server: Allow reauthentication without signing (bso#10958).
• s3-smbclient: Return success if we listed the shares (bso#10960).
• s3-smbstatus: Fix exit code of profile output (bso#10961).
• libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does (bso#10966).
• s3: smbd/modules: Fix allocate calls to follow POSIX error return convention (bso#10982).
• Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions' (bso#11006).
• idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo (bso#11006).
• winbind: Retry LogonControl RPC in ping-dc after session expiration (bso#11034).
• yast2-samba-client should be able to specify osName and osVer on AD domain join (bnc#873922).
• Lookup FSRVP share snums at runtime rather than storing them persistently (bnc#908627).
• Specify soft dependency for network-online.target in Winbind systemd service file (bnc#889175).
• Fix spoolss error response marshalling; (bso#10984).
• pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state (bso#10472).
• s4-dns: Add support for BIND 9.10 (bso#10620).
• nmbd fails to accept '--piddir' option; (bso#10711).
• S3: source3/smbd/process.c::srv_send_smb() returns true on the error path (bso#10880).
• vfs_glusterfs: Remove 'integer fd' code and store the glfs pointers (bso#10889).
• s3-nmbd: Fix netbios name truncation (bso#10896).
• spoolss: Fix handling of bad EnumJobs levels (bso#10898).
• spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905).
• s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920).
• s3:smbd: Fix file corruption using 'write cache size != 0'; (bso#10921).
• pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932).
• s3-keytab: Fix keytab array NULL termination; (bso#10933).
• Cleanup add_string_to_array and usage; (bso#10942).
• Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).
• Use the upstream tar ball, as signature verification is now able to handle compressed archives.
• Fix leak when closing file descriptor returned from dirfd; (bso#10918).
• Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031).
  • Fix handling of bad EnumJobs levels; (bso#10898).
• Remove dependency on gpg-offline as signature checking is implemented in the source validator.
• s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984).
• s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984).
• s3-libads: Add all machine account principals to the keytab; (bso#9985).
• s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717).
• Fix unstrcpy; (bso#10735).
• pthreadpool: Slightly serialize jobs; (bso#10779).
• s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797).
• s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809).
• vfs_media_harmony: Fix a crash bug; (bso#10813).
• docs: Mention incompatibility between kernel oplocks and streams_xattr; …

Samba has been updated to fix one security issue:

* CVE-2015-0240: Don't call talloc_free on an uninitialized pointer
  (bnc#917376).

Additionally, these non-security issues have been fixed:

* Realign the winbind request structure following require_membership_of
  field expansion (bnc#913001).
* Reuse connections derived from DFS referrals (bso#10123,
  fate#316512).
* Set domain/workgroup based on authentication callback value
  (bso#11059).
* Fix spoolss error response marshalling (bso#10984).
* Fix spoolss EnumJobs and GetJob responses (bso#10905, bnc#898031).
* Fix handling of bad EnumJobs levels (bso#10898).
* Fix small memory-leak in the background print process; (bnc#899558).
* Prune idle or hung connections older than 'winbind request timeout'
  (bso#3204, bnc#872912).

Security Issues:

* CVE-2015-0240
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0240>

This update fixes the following security issues with Samba:

* bnc#844720: DCERPC frag_len not checked (CVE-2013-4408)
* bnc#853347: winbind pam security problem (CVE-2012-6150)
* bnc#848101: No access check verification on stream files
  (CVE-2013-4475)

And fixes the following non-security issues:

* bnc#853021: libsmbclient0 package description contains comments
* bnc#817880: rpcclient adddriver and setdrive do not set all needed
  registry entries
* bnc#838472: Client trying to delete print job fails: Samba returns:
  WERR_INVALID_PRINTER_NAME
* bnc#854520 and bnc#849226: various upstream fixes

Security Issue references:

* CVE-2012-6150
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6150>
* CVE-2013-4408
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4408>
* CVE-2013-4475
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4475>

The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.

Richard van Eeden discovered that the Samba smbd file services incorrectly handled memory. A remote attacker could use this issue to possibly execute arbitrary code with root privileges.