Scientific Linux Samba4: 2013-02-21 Moderate Security Advisory

Date: Mon, 4 Mar 2013 13:09:36 -0600
Reply-To: Pat Riehecky 
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Organization: Fermilab
Subject: Security ERRATA Moderate: samba4 on SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Moderate: samba4 security, bug fix and enhancement update
Issue Date: 2013-02-21
CVE Numbers: CVE-2012-1182
--

A flaw was found in the Samba suite's Perl-based DCE/RPC IDL (PIDL)
compiler,
used to generate code to handle RPC calls. This could result in code
generated
by the PIDL compiler to not sufficiently protect against buffer overflows.
(CVE-2012-1182)

The samba4 packages have been upgraded to upstream version 4.0.0, which
provides a number of bug fixes and enhancements over the previous
version. In
particular, improved interoperability with Active Directory (AD)
domains. SSSD
now uses the libndr-krb5pac library to parse the Privilege Attribute
Certificate (PAC) issued by an AD Key Distribution Center (KDC).

The Cross Realm Kerberos Trust functionality provided by Identity
Management,
which relies on the capabilities of the samba4 client library, is
included as a
Technology Preview. This functionality and server libraries, is included
as a
Technology Preview. This functionality uses the libndr-nbt library to
prepare
Connection-less Lightweight Directory Access Protocol (CLDAP) messages.

Additionally, various improvements have been made to the Local Security
Authority (LSA) and Net Logon services to allow verification of trust from a
Windows system. Because the Cross Realm Kerberos Trust functionality is
considered a Technology Preview, selected samba4 components are
considered to
be a Technology Preview. For more information on which Samba packages are
considered a Technology Preview, refer to Table 5.1, "Samba4 Package
Support"
in the Release Notes, linked to from the References.

This update also fixes the following bug:

* Prior to this update, if the Active Directory (AD) server was rebooted,
Winbind sometimes failed to reconnect when requested by "wbinfo -n" or
"wbinfo
-s" commands. Consequently, looking up users using the wbinfo tool
failed. This
update applies upstream patches to fix this problem and now looking up a
Security Identifier (SID) for a username, or a username for a given SID,
works
as expected after a domain controller is rebooted.

Warning: If you upgrade from Scientific Linux 6.3 to Scientific Linux
6.4 and
you have Samba in use, you should make sure that you uninstall the package
named "samba4" to avoid conflicts during the upgrade.
--

SL6
 x86_64
 samba4-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-client-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-common-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-dc-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-dc-libs-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-debuginfo-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-devel-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-libs-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-pidl-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-python-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-swat-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-test-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-winbind-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-winbind-clients-4.0.0-55.el6.rc4.x86_64.rpm
 samba4-winbind-krb5-locator-4.0.0-55.el6.rc4.x86_64.rpm
 i386
 samba4-4.0.0-55.el6.rc4.i686.rpm
 samba4-client-4.0.0-55.el6.rc4.i686.rpm
 samba4-common-4.0.0-55.el6.rc4.i686.rpm
 samba4-dc-4.0.0-55.el6.rc4.i686.rpm
 samba4-dc-libs-4.0.0-55.el6.rc4.i686.rpm
 samba4-debuginfo-4.0.0-55.el6.rc4.i686.rpm
 samba4-devel-4.0.0-55.el6.rc4.i686.rpm
 samba4-libs-4.0.0-55.el6.rc4.i686.rpm
 samba4-pidl-4.0.0-55.el6.rc4.i686.rpm
 samba4-python-4.0.0-55.el6.rc4.i686.rpm
 samba4-swat-4.0.0-55.el6.rc4.i686.rpm
 samba4-test-4.0.0-55.el6.rc4.i686.rpm
 samba4-winbind-4.0.0-55.el6.rc4.i686.rpm
 samba4-winbind-clients-4.0.0-55.el6.rc4.i686.rpm
 samba4-winbind-krb5-locator-4.0.0-55.el6.rc4.i686.rpm

The following packages were added for dependency resolution
SL6
 x86_64
 krb5-auth-dialog-0.13-3.el6.x86_64.rpm
 krb5-devel-1.10.3-10.el6.i686.rpm
 krb5-devel-1.10.3-10.el6.x86_64.rpm
 krb5-libs-1.10.3-10.el6.i686.rpm
 krb5-libs-1.10.3-10.el6.x86_64.rpm
 krb5-pkinit-openssl-1.10.3-10.el6.x86_64.rpm
 krb5-server-1.10.3-10.el6.x86_64.rpm
 krb5-server-ldap-1.10.3-10.el6.i686.rpm
 krb5-server-ldap-1.10.3-10.el6.x86_64.rpm
 krb5-workstation-1.10.3-10.el6.x86_64.rpm
 libdrm-2.4.39-1.el6.i686.rpm
 libdrm-2.4.39-1.el6.x86_64.rpm
 libdrm-devel-2.4.39-1.el6.i686.rpm
 libdrm-devel-2.4.39-1.el6.x86_64.rpm
 libguestfs-1.16.34-2.el6.x86_64.rpm
 libguestfs-devel-1.16.34-2.el6.x86_64.rpm
 libguestfs-java-1.16.34-2.el6.x86_64.rpm
 libguestfs-java-devel-1.16.34-2.el6.x86_64.rpm
 libguestfs-javadoc-1.16.34-2.el6.x86_64.rpm
 libguestfs-tools-1.16.34-2.el6.x86_64.rpm
 libguestfs-tools-c-1.16.34-2.el6.x86_64.rpm
 libguestfs-winsupport-1.0-7.el6.x86_64.rpm
 libldb-1.1.13-3.el6.i686.rpm
 libldb-1.1.13-3.el6.x86_64.rpm
 libldb-devel-1.1.13-3.el6.i686.rpm
 libldb-devel-1.1.13-3.el6.x86_64.rpm
 libsmbclient-3.6.9-151.el6.i686.rpm
 libsmbclient-3.6.9-151.el6.x86_64.rpm
 libsmbclient-devel-3.6.9-151.el6.i686.rpm
 libsmbclient-devel-3.6.9-151.el6.x86_64.rpm
 libtalloc-2.0.7-2.el6.i686.rpm
 libtalloc-2.0.7-2.el6.x86_64.rpm
 libtalloc-devel-2.0.7-2.el6.i686.rpm
 libtalloc-devel-2.0.7-2.el6.x86_64.rpm
 libtdb-1.2.10-1.el6.i686.rpm
 libtdb-1.2.10-1.el6.x86_64.rpm
 libtdb-devel-1.2.10-1.el6.i686.rpm
 libtdb-devel-1.2.10-1.el6.x86_64.rpm
 libtevent-0.9.17-1.el6.i686.rpm
 libtevent-0.9.17-1.el6.x86_64.rpm
 libtevent-devel-0.9.17-1.el6.i686.rpm
 libtevent-devel-0.9.17-1.el6.x86_64.rpm
 ocaml-libguestfs-1.16.34-2.el6.x86_64.rpm
 ocaml-libguestfs-devel-1.16.34-2.el6.x86_64.rpm
 perl-Sys-Guestfs-1.16.34-2.el6.x86_64.rpm
 pyldb-1.1.13-3.el6.x86_64.rpm
 pyldb-devel-1.1.13-3.el6.x86_64.rpm
 pytalloc-2.0.7-2.el6.x86_64.rpm
 pytalloc-devel-2.0.7-2.el6.x86_64.rpm
 python-libguestfs-1.16.34-2.el6.x86_64.rpm
 python-tdb-1.2.10-1.el6.x86_64.rpm
 python-tevent-0.9.17-1.el6.x86_64.rpm
 ruby-libguestfs-1.16.34-2.el6.x86_64.rpm
 samba-3.6.9-151.el6.x86_64.rpm
 samba-client-3.6.9-151.el6.x86_64.rpm
 samba-common-3.6.9-151.el6.i686.rpm
 samba-common-3.6.9-151.el6.x86_64.rpm
 samba-doc-3.6.9-151.el6.x86_64.rpm
 samba-domainjoin-gui-3.6.9-151.el6.x86_64.rpm
 samba-swat-3.6.9-151.el6.x86_64.rpm
 samba-winbind-3.6.9-151.el6.x86_64.rpm
 samba-winbind-clients-3.6.9-151.el6.i686.rpm
 samba-winbind-clients-3.6.9-151.el6.x86_64.rpm
 samba-winbind-devel-3.6.9-151.el6.i686.rpm
 samba-winbind-devel-3.6.9-151.el6.x86_64.rpm
 samba-winbind-krb5-locator-3.6.9-151.el6.x86_64.rpm
 tdb-tools-1.2.10-1.el6.x86_64.rpm

 i386
 krb5-auth-dialog-0.13-3.el6.i686.rpm
 krb5-devel-1.10.3-10.el6.i686.rpm
 krb5-libs-1.10.3-10.el6.i686.rpm
 krb5-pkinit-openssl-1.10.3-10.el6.i686.rpm
 krb5-server-1.10.3-10.el6.i686.rpm
 krb5-server-ldap-1.10.3-10.el6.i686.rpm
 krb5-workstation-1.10.3-10.el6.i686.rpm
 libdrm-2.4.39-1.el6.i686.rpm
 libdrm-devel-2.4.39-1.el6.i686.rpm
 libldb-1.1.13-3.el6.i686.rpm
 libldb-devel-1.1.13-3.el6.i686.rpm
 libsmbclient-3.6.9-151.el6.i686.rpm
 libsmbclient-devel-3.6.9-151.el6.i686.rpm
 libtalloc-2.0.7-2.el6.i686.rpm
 libtalloc-devel-2.0.7-2.el6.i686.rpm
 libtdb-1.2.10-1.el6.i686.rpm
 libtdb-devel-1.2.10-1.el6.i686.rpm
 libtevent-0.9.17-1.el6.i686.rpm
 libtevent-devel-0.9.17-1.el6.i686.rpm
 pyldb-1.1.13-3.el6.i686.rpm
 pyldb-devel-1.1.13-3.el6.i686.rpm
 pytalloc-2.0.7-2.el6.i686.rpm
 pytalloc-devel-2.0.7-2.el6.i686.rpm
 python-tdb-1.2.10-1.el6.i686.rpm
 python-tevent-0.9.17-1.el6.i686.rpm
 samba-3.6.9-151.el6.i686.rpm
 samba-client-3.6.9-151.el6.i686.rpm
 samba-common-3.6.9-151.el6.i686.rpm
 samba-doc-3.6.9-151.el6.i686.rpm
 samba-domainjoin-gui-3.6.9-151.el6.i686.rpm
 samba-swat-3.6.9-151.el6.i686.rpm
 samba-winbind-3.6.9-151.el6.i686.rpm
 samba-winbind-clients-3.6.9-151.el6.i686.rpm
 samba-winbind-devel-3.6.9-151.el6.i686.rpm
 samba-winbind-krb5-locator-3.6.9-151.el6.i686.rpm
 tdb-tools-1.2.10-1.el6.i686.rpm

- Scientific Linux Development Team