CVE-2015-7560

The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.

Jeremy Allison discovered that Samba incorrectly handled ACLs on symlink paths. A remote attacker could use this issue to overwrite the ownership of ACLs using symlinks (CVE-2015-7560).

These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target. (bso#11648 bsc#968222)

Also the following bugs were fixed:

• Add quotes around path of update-apparmor-samba-profile; (bsc#962177).
• Prevent access denied if the share path is '/'; (bso#11647); (bsc#960249).
• Ensure samlogon fallback requests are rerouted after kerberos failure; (bsc#953382).
• samba: winbind crash -> netlogon_creds_client_authenticator; (bsc#953972).

This update for the samba server fixes the following issues:

Security issue fixed:

• CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); (bsc#968222).

Other bugs fixed:

• Enable clustering (CTDB) support; (bsc#966271).
• s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).
• vfs_fruit: Fix renaming directories with open files; (bso#11065).
• Fix MacOS finder error 36 when copying folder to Samba; (bso#11347).
• s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400).
• Fix copying files with vfs_fruit when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466).
• s3:libsmb: Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624).
• Reduce the memory footprint of empty string options; (bso#11625).
• lib/async_req: Do not install async_connect_send_test; (bso#11639).
• docs: Fix typos in man vfs_gpfs; (bso#11641).
• smbd: make 'hide dot files' option work with 'store dos attributes = yes'; (bso#11645).
• smbcacls: Fix uninitialized variable; (bso#11682).
• s3:smbd: Ignore initial allocation size for directory creation; (bso#11684).
• Add quotes around path of update-apparmor-samba-profile; (bsc#962177).
• Prevent access denied if the share path is '/'; (bso#11647); (bsc#960249).
• Ensure samlogon fallback requests are rerouted after kerberos failure; (bsc#953972).
• samba: winbind crash -> netlogon_creds_client_authenticator; (bsc#953972)

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); (bsc#968222).

Bug fixed:

• Fix leaking memory in libsmbclient: Add missing talloc stackframe; (bso#11177); (bsc#967017).

This update for samba fixes the following issues:

Security issue fixed:

• CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); (bsc#968222).

Bugs fixed:

• Fix leaking memory in libsmbclient: Add missing talloc stackframe; (bso#11177); (bsc#967017).
• Ensure samlogon fallback requests are rerouted after kerberos failure; (bsc#953382).
• Ensure attempt to ssh into locked account triggers 'Your account is disabled.....' to the console; (bsc#953382).
• Make the winbind package depend on the matching libwbclient version and vice versa; (bsc#936909).

Jeremy Allison discovered that Samba incorrectly handled ACLs on symlink paths. A remote attacker could use this issue to overwrite the ownership of ACLs using symlinks. (CVE-2015-7560)

Garming Sam and Douglas Bagnall discovered that the Samba internal DNS server incorrectly handled certain DNS TXT records. A remote attacker could use this issue to cause Samba to crash, resulting in a denial of service, or possibly obtain uninitialized memory contents. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-0771)

It was discovered that the Samba Web Administration Tool (SWAT) was vulnerable to clickjacking and cross-site request forgery attacks. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-0213, CVE-2013-0214)