Fixes for:
o CVE-2019-10218: Client code can return filenames containing path separators.
o CVE-2019-14833: Samba AD DC check password script does not receive the
full password.
o CVE-2019-14847: User with "get changes" permission can crash AD DC
LDAP server via dirsync.
Release notes for 4.9.14 and 4.9.15:
https://www.samba.org/samba/history/samba-4.9.14.htmlhttps://www.samba.org/samba/history/samba-4.9.15.html
Tested by and ok gonzalo@
4.8.x is not supported upstream any more, so better update before 6.6 is
tagged if we want to benefit from upstream's security updates.
To stay on the safe side, this update doesn't enable the LMDB backend
which has become the default upstream. samba requires a 64 bits system
to use LMDB (32 bits systems can keep on using tdb); and LMDB has always
been a problem child on OpenBSD anyway.
Lightly tested by me, bulk build test and ok ajacoutot@ (thanks!)
Fixes:
o CVE-2018-1139 (Weak authentication protocol allowed.)
o CVE-2018-1140 (Denial of Service Attack on DNS and LDAP server.)
o CVE-2018-10858 (Insufficient input validation on client directory
listing in libsmbclient.)
o CVE-2018-10918 (Denial of Service Attack on AD DC
DRSUAPI server.)
o CVE-2018-10919 (Confidential attribute disclosure
from the AD LDAP server.)
See https://www.samba.org/samba/history/samba-4.8.4.html for more
information.
* CVE-2016-2119 (Client side SMB2/3 required signing can be downgraded)
ok ajacoutot@, Ian McWilliam, sthen@ on a previous version. ok danj@
who noted missing entries in PLIST.
i386 build by danj@, ok sthen@
The changelog between 4.1.23 and 4.3.6 is too big to be described here.
The point of updating now is that 4.1.x won't receive updates for the
freshly published security advisories. samba-4.3.8 will follow.
ok ajacoutot@
Upcoming commits will add additional tweaks.
Many thanks to Vadim Zhukov (who did most of the work), Ian McWilliam
(co-maintainer), Stuart Henderson who provided lots of support and
feedback, Antoine Jacoutot who patiently dealt with my broken diffs,
and more generally all the people involved. Most of the recent work was
done during p2k15 and c2k15.
which should all be started/stopped together), previously "restart" would
restart each sub-daemon in turn, but actually it should stop all daemons
and only then start them again. Additionally, as suggested by ajacoutot,
stop the procedure and return an error if stopping one of the rc scripts
failed. ok ajacoutot@ rpe@
are executable, I needed it for the bacula script which runs daemons split
between two packages, ajacoutot suggested applying to other similar scripts.
