summaryrefslogtreecommitdiff
path: root/net/samba
AgeCommit message (Collapse)AuthorFilesLines
2015-03-01Account for the libraries installed on FreeBSDsevan1-0/+3
Reviewed by wiz@
2015-02-24Update samba package to 3.6.25.taca2-6/+6
============================== Release Notes for Samba 3.6.25 February 23, 2015 ============================== This is a security release in order to address CVE-2015-0240 (Unexpected code execution in smbd). o CVE-2015-0240: All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon. A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges. o CVE-2014-0178: In preparing a response to an authenticated FSCTL_GET_SHADOW_COPY_DATA or FSCTL_SRV_ENUMERATE_SNAPSHOTS client request, affected versions of Samba do not initialize 8 bytes of the 16 byte SRV_SNAPSHOT_ARRAY response field. The uninitialized buffer is sent back to the client. A non-default VFS module providing the get_shadow_copy_data_fn() hook must be explicitly enabled for Samba to process the aforementioned client requests. Therefore, only configurations with "shadow_copy" or "shadow_copy2" specified for the "vfs objects" parameter are vulnerable.
2015-02-02SunOS inotify requires sys/filio.h for FIONREAD.jperkin2-1/+18
2015-01-23tell pidfile nameobache3-3/+6
2015-01-20Do not enable ads on Darwin-10+ by default.wiz1-2/+6
Fixes PR 49590 by Youri Mouton.
2014-07-21Haiku also supports some vfs modules too.obache1-0/+3
from diger.
2014-07-21Move Darwin specific PLIST entries to PLIST.Darwin, same as SunOS, Linux.obache3-11/+6
2014-06-24Update samba to 3.6.24, security release.taca2-7/+6
============================== Release Notes for Samba 3.6.24 June 23, 2014 ============================== This is a security release in order to address CVE-2014-0244 (Denial of service - CPU loop) and CVE-2014-3493 (Denial of service - Server crash/memory corruption). o CVE-2014-0244: All current released versions of Samba are vulnerable to a denial of service on the nmbd NetBIOS name services daemon. A malformed packet can cause the nmbd server to loop the CPU and prevent any further NetBIOS name service. This flaw is not exploitable beyond causing the code to loop expending CPU resources. o CVE-2014-3493: All current released versions of Samba are affected by a denial of service crash involving overwriting memory on an authenticated connection to the smbd file server.
2014-06-18Bump PKGREVISION for cups -> cups15 change.wiz1-2/+2
2014-06-18Switch all cups packages to use cups15.wiz1-2/+2
2014-06-10security/PAM/module.mk is gone.joerg1-3/+4
2014-05-29Bump for perl-5.20.0.wiz1-2/+2
Do it for all packages that * mention perl, or * have a directory name starting with p5-*, or * depend on a package starting with p5- like last time, for 5.18, where this didn't lead to complaints. Let me know if you have any this time.
2014-05-14Add SMF manifestwiedi2-1/+47
2014-03-18Remove "us5.samba.org" URL which no longer works.tron1-2/+1
2014-03-18Add patch to build problem with newer readline.taca2-1/+17
2014-03-17Update samba to 3.6.23.taca2-7/+6
============================== Release Notes for Samba 3.6.23 March 11, 2014 ============================== This is a security release in order to address CVE-2013-4496 (Password lockout not enforced for SAMR password changes). o CVE-2013-4496: Samba versions 3.4.0 and above allow the administrator to implement locking out Samba accounts after a number of bad password attempts. However, all released versions of Samba did not implement this check for password changes, such as are available over multiple SAMR and RAP interfaces, allowing password guessing attacks.
2014-03-13Set USE_GCC_RUNTIME=yes for packages which build shared libraries but dojperkin1-1/+3
not use libtool to do so. This is required to correctly depend upon a gcc runtime package (e.g. gcc47-libs) when using USE_PKGSRC_GCC_RUNTIME.
2014-03-11Remove example rc.d scripts from PLISTs.jperkin1-5/+1
These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or ignored otherwise.
2014-03-03Replace log dir in the default sample config file correctly.obache3-6/+12
Bump PKGREVISION.
2014-03-03simplify with SUBST_VARS.obache1-7/+2
2014-02-27Remove pam_smbpass README, build machine environment issue, apologies.jperkin1-2/+1
2014-02-26Add missing README for the pam case.jperkin1-1/+2
2014-02-12Recursive PKGREVISION bump for OpenSSL API version bump.tron1-1/+2
2014-01-28Use GNU_CONFIGURE_LIBDIR for --libdir.obache1-2/+2
2013-12-09Update samba to 3.6.22; Security fix for CVE-2012-6150.taca2-6/+6
Changes since 3.6.21: --------------------- o Jeremy Allison <jra@samba.org> * BUG 10185: CVE-2013-4408: Correctly check DCE-RPC fragment length field. o Stefan Metzmacher <metze@samba.org> * BUG 10185: CVE-2013-4408: Correctly check DCE-RPC fragment length field. o Noel Power <noel.power@suse.com> * BUGs 10300, 10306: CVE-2012-6150: Fail authentication if user isn't member of *any* require_membership_of specified groups. Changes since 3.6.20: --------------------- o Jeremy Allison <jra@samba.org> * BUG 10139: Valid utf8 filenames cause "invalid conversion error" messages. * BUG 10167: s3-smb2 server: smb2 breaks "smb encryption = mandatory". * BUG 10187: Missing talloc_free can leak stackframe in error path. * BUG 10247: xattr: Fix listing EAs on *BSD for non-root users. o Korobkin <korobkin+samba@gmail.com> * BUG 10118: Raise debug level for being unable to open a printer. o Volker Lendecke <vl@samba.org> * BUG 10195: nsswitch: Fix short writes in winbind_write_sock. o Arvid Requate <requate@univention.de> * BUG 10267: Fix Windows 8 printing via local printer drivers. o Andreas Schneider <asn@cryptomilk.org> * BUG 10194: Make offline logon cache updating for cross child domain group membership.
2013-11-12Changes 3.6.20:adam2-6/+6
These are security releases in order to address CVE-2013-4475 (ACLs are not checked on opening an alternate data stream on a file or directory) and CVE-2013-4476 (Private key in key.pem world readable).
2013-10-09Update samba to 3.6.19.taca2-6/+6
Changes since 3.6.18: --------------------- o Jeremy Allison <jra@samba.org> * BUG 5917: Make Samba work on site with Read Only Domain Controller. o Christian Ambach <ambi@samba.org> * BUG 8955: NetrServerPasswordSet2 timeout is too short. o Günther Deschner <gd@samba.org> * BUG 9899: Fix fallback to ncacn_np in cm_connect_lsat(). * BUG 9615: Fix fallback to ncacn_np in cm_connect_lsat(). * BUG 10127: Fix 'smbstatus' as non-root user. o Volker Lendecke <vl@samba.org> * BUG 8955: Give machine password changes 10 minutes of time. * BUG 10106: Honour output buffer length set by the client for SMB2 GetInfo requests. * BUG 10114: Handle Dropbox (write-only-directory) case correctly in pathname lookup. o Karolin Seeger <kseeger@samba.org> * BUG 10076: Fix variable list in man vfs_crossrename. o Andreas Schneider <asn@samba.org> * BUG 9994: s3-winbind: Do not delete an existing valid credential cache. * BUG 10073: 'net ads join': Fix segmentation fault in create_local_private_krb5_conf_for_domain. o Richard Sharpe <realrichardsharpe@gmail.com> * BUG 10097: MacOSX 10.9 will not follow path-based DFS referrals handed out by Samba.
2013-08-14Changes 3.6.18:adam2-6/+6
* BUG 9777: vfs_dirsort uses non-stackable calls, dirfd(), malloc instead of talloc and doesn't cope with directories being modified whilst reading. * BUG 9678: Windows 8 Roaming profiles fail. * BUG 9636: Fix parsing linemarkers in preprocessor output. * BUG 9880: Use of wrong RFC2307 primary group field. * BUG 9983: Fix output of syslog-facility check. * BUG 10064: Linux kernel oplock breaks can miss signals.
2013-08-12Update samba to 3.6.17, security release.taca18-78/+78
============================== Release Notes for Samba 3.6.17 August 05, 2013 ============================== This is a security release in order to address CVE-2013-4124 (Missing integer wrap protection in EA list reading can cause server to loop with DOS). o CVE-2013-4124: All current released versions of Samba are vulnerable to a denial of service on an authenticated or guest connection. A malformed packet can cause the smbd server to loop the CPU performing memory allocations and preventing any further service. A connection to a file share, or a local account is needed to exploit this problem, either authenticated or unauthenticated if guest connections are allowed. This flaw is not exploitable beyond causing the code to loop allocating memory, which may cause the machine to exceed memory limits. Changes since 3.6.16: --------------------- o Jeremy Allison <jra@samba.org> * BUG 10010: CVE-2013-4124: Missing integer wrap protection in EA list reading can cause server to loop with DOS.
2013-07-15* .include "../../devel/readline/buildlink3.mk" with USE_GNU_READLINE=yesryoon1-2/+1
are replaced with .include "../../devel/readline/buildlink3.mk", and USE_GNU_READLINE are removed, * .include "../../devel/readline/buildlink3.mk" without USE_GNU_READLINE are replaced with .include "../../mk/readline.buildlink3.mk".
2013-07-04Fix URL.wiz1-2/+2
2013-07-03Changes 3.6.16:adam4-15/+19
* BUG 9881: Link dbwrap_tool and dbwrap_torture against libtevent. * BUG 9722: Properly handle Oplock breaks in compound requests. * BUG 9822: Fix crash bug during Win8 sync. * BUG 9927: errno gets overwritten in call to check_parent_exists(). * BUG 8997: Change libreplace GPL source to LGPL. * BUG 9900: is_printer_published GUID retrieval. * BUG 9941: Fix a bug of drvupgrade of smbcontrol. * BUG 9868: Don't know how to make LIBNDR_PREG_OBJ. * BUG 9688: Remove "experimental" label on "max protocol=SMB2" parameter. * BUG 9881: Check for system libtevent.
2013-06-12Remove GNU_CONFIGURE_LIBDIR.wiz1-2/+2
Rationale: undocumented, easily replaced with "CONFIGURE_ARGS+=--libdir=" and only used by 10 packages.
2013-05-31Bump all packages for perl-5.18, thatwiz1-1/+2
a) refer 'perl' in their Makefile, or b) have a directory name of p5-*, or c) have any dependency on any p5-* package Like last time, where this caused no complaints.
2013-05-09Changes 3.6.15:adam2-6/+6
* BUG 9746: Fix "guest ok", "force user" and "force group" for guest users. * BUG 9830: Fix panic in nt_printer_publish_ads. * BUG 9854: Fix crash bug in Winbind. * BUG 9817: Fix 'map untrusted to domain' with NTLMv2.
2013-04-30Changes 3.6.14:adam3-8/+8
* BUG 9130: Certain xattrs cause Windows error 0x800700FF. * BUG 9724: Use is_encrypted_packet() function correctly inside server. * BUG 9733: Fix 'smbcontrol close-share' is not working. * BUG 9747: Make sure that we only propogate the INHERITED flag when we are allowed to. * BUG 9748: Remove unneeded fstat system call from hot read path. * BUG 9811: Fix bug in old create temp SMB request. Only use VFS functions. * BUG 9650: New or deleted CUPS printerqueues are not recognized by Samba. * BUG 9807: wbinfo: Fix segfault in wbinfo_pam_logon. * BUG 9727: wkssvc: Fix NULL pointer dereference. * BUG 9736: smbd: Tune "dir" a bit. * BUG 9775: Fix segfault for "artificial" conn_structs. * BUG 9809: RHEL SPEC: Package dbwrap_tool man page. * BUG 9139: Fix the username map optimization. * BUG 9699: Fix adding case sensitive spn. * BUG 9723: Add a tool to migrate latin1 printing tdbs to registry. * BUG 9735: Fix Winbind separator in upn to username conversion. * BUG 9766: Cache name_to_sid/sid_to_name correctly.
2013-04-19Removeing -> Removingsborrill1-2/+2
2013-02-16Recursive bump for png-1.6.wiz1-2/+2
2013-02-06PKGREVISION bumps for the security/openssl 1.0.1d update.jperkin1-1/+2
2013-01-30Update samba to 3.6.12.taca2-9/+8
============================== Release Notes for Samba 3.6.12 January 30, 2013 ============================== This is a security release in order to address CVE-2013-0213 (Clickjacking issue in SWAT) and CVE-2013-0214 (Potential XSRF in SWAT). o CVE-2013-0213: All current released versions of Samba are vulnerable to clickjacking in the Samba Web Administration Tool (SWAT). When the SWAT pages are integrated into a malicious web page via a frame or iframe and then overlaid by other content, an attacker could trick an administrator to potentially change Samba settings. In order to be vulnerable, SWAT must have been installed and enabled either as a standalone server launched from inetd or xinetd, or as a CGI plugin to Apache. If SWAT has not been installed or enabled (which is the default install state for Samba) this advisory can be ignored. o CVE-2013-0214: All current released versions of Samba are vulnerable to a cross-site request forgery in the Samba Web Administration Tool (SWAT). By guessing a user's password and then tricking a user who is authenticated with SWAT into clicking a manipulated URL on a different web page, it is possible to manipulate SWAT. In order to be vulnerable, the attacker needs to know the victim's password. Additionally SWAT must have been installed and enabled either as a standalone server launched from inetd or xinetd, or as a CGI plugin to Apache. If SWAT has not been installed or enabled (which is the default install state for Samba) this advisory can be ignored. Changes since 3.6.11: -------------------- o Kai Blin <kai@samba.org> * BUG 9576: CVE-2013-0213: Fix clickjacking issue in SWAT. * BUG 9577: CVE-2013-0214: Fix potential XSRF in SWAT.
2013-01-26Revbump after graphics/jpeg and textproc/icuadam1-2/+2
2012-12-16recursive bump from cyrus-sasl libsasl2 shlib major bump.obache1-1/+2
2012-12-14Major enhancements in Samba 3.6.10 include:adam4-37/+20
o Respond correctly to FILE_STREAM_INFO requests. o Fix segfault when "default devmode" is disabled. o Fix segfaults in "log level = 10" on Solaris.
2012-10-30resolve the CONFLICT between tdb and samba - make sambe usedrochner3-20/+14
an external libtdb instead of the internal duplicate
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-3/+1
2012-10-03Bump all packages that use perl, or depend on a p5-* package, orwiz1-2/+2
are called p5-*. I hope that's all of them.
2012-08-19NSS winbind option install script fixes:sbd4-11/+41
1) Move the INSTALL_TEMPLATES line to the 'winbind' option section. 2) Enable the install script on all platforms. 3) Use the value of ${NSS_WINBIND} in the script as the name of the library (should work on all platforms). 4) In the install script only create the symlink if ${NSS_WINBIND} doesn't start with '@comment' (i.e. no nss winbind on this platform) and the target file exists and the symlink _doesn't_ already exist. 5) Create a DEINSTALL_TEMPLATES to remove the nss winbind symlink if it exists and point to the correct target. Bump PKGREVISION.
2012-07-06Update to Samba 3.6.6asau4-35/+131
============================= Release Notes for Samba 3.6.6 June 25, 2012 ============================= This is is the latest stable release of Samba 3.6. Major enhancements in Samba 3.6.6 include: o Fix possible memory leaks in the Samba master process (bug #8970). o Fix uninitialized memory read in talloc_free(). o Fix joining of XP Pro workstations to 3.6 DCs (bug #8373). Changes since 3.6.5: -------------------- o Michael Adam <obnox@samba.org> * BUG 8738: SMB2 server will not release unused shares. * BUG 8749: Sign non guest sessions in SessionSetup. * BUG 8921: Fix race writing registry values. o Jeremy Allison <jra@samba.org> * BUG 8373: Fix joining of XP Pro workstations to 3.6 DCs. * BUG 8627: Fix crash bug in dns_create_probe when dns_create_update fails. * BUG 8723: Add pthread-based aio VFS module. * BUG 8784: When calculating the share security mask, take priviliges into account for the connecting user. * BUG 8811: sd_has_inheritable_components segfaults on an SD that se_access_check accepts. * BUG 8837: Fix crash in smbd when deleting directory and veto files are enabled. * BUG 8857: Setting traverse rights fails to enable directory traversal when acl_xattr in use. * BUG 8882: Broken processing of %U with vfs_full_audit when force user is set. * BUG 8897: Make winbind_krb5_locator not only returning one IP address. * BUG 8910: resolve_ads() code can return zero addresses and miss valid DC IP addresses. * BUG 8922: smbclient's tarmode insists on listing excluded directories. * BUG 8953: Winbind can hang as nbt_getdc() has no timeout. * BUG 8957: Typo in pam_winbindd code MUST fix. * BUG 8970: Fix possible memory leaks in the Samba master process. * BUG 8971: cleanup_timeout_fn() is called too often, on exiting when an smbd is idle. * BUG 8972: Directory group write permission bit is set if unix extensions are enabled. o Christian Ambach <ambi@samba.org> * BUG 8406: Fix a return code check in Winbind. * BUG 8807: Fix crash in dcerpc_lsa_lookup_sids_noalloc() crashes when groups has more than 1000 groups. o Andrew Bartlett <abartlet@samba.org> * BUG 8599: Only use SamLogonEx when we can get unencrypted session keys. * BUG 8727: Fix smbclients with posix large reads. * BUG 8943: Slow but responsive DC can lock up Winbind for > 10 minutes at a time. o Björn Baumbach <bb@sernet.de> * BUG 7564: Fix default name resolve order in the manpage. * BUG 8554, 8612, 8748: Add new printers to registry. * BUG 8789: Remove whitespace in example samba.ldif. o Alexander Bokovoy <ab@samba.org> * BUG 8988: Avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute(). o Alejandro Escanero Blanco <aescanero@gmail.com> * BUG 8798: The primary rid should be in the groups rid array. o Ira Cooper <samba@ira.wakeful.net> * BUG 8729: Fix getpass regressions on Solaris/Illumos. * BUG 8743: Fix configure.developer builds on Solaris. * BUG 8910: Fix bad bugfix for bug #8910. * BUG 8952: Fix negative SID->uid/gid cache handling. * BUG 8995: Use fsp_persistent_id() as persistent_file_id part for SMB2. o David Disseldorp <ddiss@samba.org> * BUG 8762: Fix crash in printer_list_set_printer(). o Olaf Flebbe <o.flebbe@science-computing.de> * BUG 8859: Fix assertion in reg_parse. o Björn Jacke <bj@sernet.de> * BUG 8732: Fix compile of krb5 locator on Solaris. * BUG 8869: Remove outdated netscape ds 5 schema file. * BUG 8978: Remove dependency on automake for 'make everything'. o Steve Langasek <steve.langasek@ubuntu.com> * BUG 8920: Fix null dereference in pdb_interface. o Volker Lendecke <vl@samba.org> * Fix uninitialized memory read in talloc_free(). * BUG 8567: Fix segfault in dom_sid_compare. * BUG 8733: Delete streams on directories (streams_depot). * BUG 8760: Add SERVERID_UNIQUE_ID_NOT_TO_VERIFY. * BUG 8836: Fix segfaults on "smbcontrol close-share" in aio_fork. * BUG 8861: Fix a segfault with debug level 3 on Solaris. * BUG 8904: Fix Winbind crash triggered by 'wbinfo --lookup-sids ""'. * BUG 8998: Notify code can miss a ChDir. o Stefan Metzmacher <metze@samba.org> * BUG 8139: Ignore SMBecho errors (the server may not support it). * BUG 8527: db_ctdb_traverse fails to traverse records created within the current transaction. * BUG 8311: Winzip occasionally can not read files out of an open winzip dialog. * BUG 8739: Fill the sids array of the info in wbcAuthUserInfo_to_netr_SamInfo3(). * BUG 8749: Sign non guest sessions in SessionSetup. * BUG 8995: Use fsp_persistent_id() as persistent_file_id part for SMB2. o Matthieu Patou <mat@matws.net> * BUG 8599: Set the can_do_validation6 also for trusted domain. * BUG 8714: Catch with pid filename's change when config file is not smb.conf. * BUG 8734: Don't try to do clever thing if the username is not found while authenticating through Winbind. * BUG 8771: Winbind takes up to 20 minutes to change from DC 1 to DC 2. * BUG 8975: Call dump_core_setup after command line option has been parsed. o SATOH Fumiyasu <fumiyas@osstech.co.jp> * BUG 8826: Prepend '/' to filename argument (docs). o Andreas Schneider <asn@samba.org> * BUG 8944 and 8567: Don't lookup the system user in pdb. o Richard Sharpe <realrichardsharpe@gmail.com> * BUG 8768: Honor SeTakeOwnershipPrivilege when file opened with SEC_STD_WRITE_OWNER. * BUG 8797: Correctly handle DENY ACEs when privileges apply. * BUG 8822: Fix building out-of-tree modules. * BUG 8945: vfs_acl_common discards errors from writing to the underlying storage. * BUG 8970: Fix possible memory leaks in the Samba master process. o Simo Sorce <idra@samba.org> * BUG 8915: Fix pam_winbind build against newer iniparser library. o Joseph Tam <jtam.home@gmail.com> * BUG 8877: Syslog broken owing to mistyping of debug_settings.syslog. o Ralph Wuerthner <ralph.wuerthner@de.ibm.com> * BUG 8845: Move print_backend_init() behind init_system_info().
2012-05-02Update samba to 3.6.5.taca2-6/+6
============================= Release Notes for Samba 3.6.5 April 30, 2012 ============================= This is a security release in order to address CVE-2012-2111 (Incorrect permission checks when granting/removing privileges can compromise file server security). o CVE-2012-2111: Samba 3.4.x to 3.6.4 are affected by a vulnerability that allows arbitrary users to modify privileges on a file server.
2012-04-26Add PLIST.SunOS.hans1-0/+3
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 03:25:11 +0000