Samba 4.6.14 (gzipped)
Signature
Patch (gzipped) against Samba 4.6.13
Signature
==============================
Release Notes for Samba 4.6.14
March 13, 2018
=============================
This is a security release in order to address the following defects:
o CVE-2018-1050 (Denial of Service Attack on external print server.)
o CVE-2018-1057 (Authenticated users can change other users' password.)
=======
Details
=======
o CVE-2018-1050:
All versions of Samba from 4.0.0 onwards are vulnerable to a denial of
service attack when the RPC spoolss service is configured to be run as
an external daemon. Missing input sanitization checks on some of the
input parameters to spoolss RPC calls could cause the print spooler
service to crash.
There is no known vulnerability associated with this error, merely a
denial of service. If the RPC spoolss service is left by default as an
internal service, all a client can do is crash its own authenticated
connection.
o CVE-2018-1057:
On a Samba 4 AD DC the LDAP server in all versions of Samba from
4.0.0 onwards incorrectly validates permissions to modify passwords
over LDAP allowing authenticated users to change any other users'
passwords, including administrative users.
Possible workarounds are described at a dedicated page in the Samba wiki:
https://wiki.samba.org/index.php/CVE-2018-1057
Changes since 4.6.12:
---------------------
o Jeremy Allison <jra@samba.org>
* BUG 11343: CVE-2018-1050: Codenomicon crashes in spoolss server code.
o Ralph Boehme <slow@samba.org>
* BUG 13272: CVE-2018-1057: Unprivileged user can change any user (and admin)
password.
o Stefan Metzmacher <metze@samba.org>
* BUG 13272: CVE-2018-1057: Unprivileged user can change any user (and admin)
password.