CVE-2014-0178

Updated samba packages fix security vulnerabilities:

Information leak vulnerability in the VFS code, allowing an authenticated user to retrieve eight bytes of uninitialized memory when shadow copy is enabled (CVE-2014-0178).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are vulnerable to a denial of service on the nmbd NetBIOS name services daemon. A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS name service (CVE-2014-0244).

Samba versions before 3.6.24, 4.0.19, and 4.1.9 are affected by a denial of service crash involving overwriting memory on an authenticated connection to the smbd file server (CVE-2014-3493).

These are all security issues fixed in the ctdb-4.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following security issues with Samba:

* bnc#844720: DCERPC frag_len not checked (CVE-2013-4408)
* bnc#853347: winbind pam security problem (CVE-2012-6150)
* bnc#848101: No access check verification on stream files
  (CVE-2013-4475)

And fixes the following non-security issues:

* bnc#853021: libsmbclient0 package description contains comments
* bnc#817880: rpcclient adddriver and setdrive do not set all needed
  registry entries
* bnc#838472: Client trying to delete print job fails: Samba returns:
  WERR_INVALID_PRINTER_NAME
* bnc#854520 and bnc#849226: various upstream fixes

Security Issue references:

* CVE-2012-6150
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6150>
* CVE-2013-4408
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4408>
* CVE-2013-4475
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4475>

Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.

Christof Schmitt discovered that Samba incorrectly initialized a certain response field when vfs shadow copy was enabled. A remote authenticated attacker could use this issue to possibly obtain sensitive information. This issue only affected Ubuntu 13.10 and Ubuntu 14.04 LTS. (CVE-2014-0178)

It was discovered that the Samba internal DNS server incorrectly handled QR fields when processing incoming DNS messages. A remote attacker could use this issue to cause Samba to consume resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-0239)

Daniel Berteaud discovered that the Samba NetBIOS name service daemon incorrectly handled certain malformed packets. A remote attacker could use this issue to cause Samba to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0244)

Simon Arlott discovered that Samba incorrectly handled certain unicode path names. A remote authenticated attacker could use this issue to cause Samba to stop responding, resulting in a denial of service. (CVE-2014-3493)