Bug 40853

Summary:	Samba: Multiple issues (3.2)
Product:	UCS	Reporter:	Arvid Requate <requate>
Component:	Security updates	Assignee:	Arvid Requate <requate>
Status:	CLOSED FIXED	QA Contact:	Felix Botner <botner>
Severity:	normal
Priority:	P4	CC:	gohmann, walkenhorst
Version:	UCS 3.2	Flags:	requate: Patch_Available+
Target Milestone:	UCS 3.2-8-errata
Hardware:	Other
OS:	Linux
What kind of report is it?:	---	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):	Security
Max CVSS v3 score:

Description Arvid Requate

2016-03-07 21:18:02 CET

The patch for CVE-2015-5252 introduced via Bug 40223 causes a regression for the special share path "/", see https://bugzilla.samba.org/show_bug.cgi?id=11647.


Additionally, there will be a security update on the 8th of March, currently embargoed:

* Getting and setting Windows ACLs on symlinks can change permissions on link target (CVE-2015-7560)

Comment 1 Arvid Requate

2016-03-07 21:52:36 CET

Unfortunately 99_sambabug11647.patch doesn't work with repo-ng + dpkg-buildpackage + quilt, apparently because it adjusts changes that 99_sambabug11395.patch has made. It's somehow related to patch order but I was unable to find a workaround in reasonable time. Since the issue is a corner case and not security related, we'll leave it at that currently. It's more important to get the CVE-2015-7560 fix out in a timely fashion.

Advisory: samba.yaml

Comment 2 Arvid Requate

2016-03-07 22:05:18 CET

The build failed again..

Comment 3 Arvid Requate

2016-03-07 22:19:57 CET

I adjusted part7 and part8 of the patch for CVE-2015-7560. This is necessary because this upstream change is missing in UCS: https://git.samba.org/?p=samba.git;a=commit;h=569a4e10d9e063f79ed51a4381df80c19904d9bd .

Advisory updated.

Comment 4 Arvid Requate

2016-03-08 12:55:43 CET

Another patch had to be backported I called it 99_CVE-2015-7560-part0.patch.

Advisory updated.

Comment 5 Felix Botner

2016-03-08 16:52:48 CET

OK - built with patches
OK - installation
OK - simple samba tests (windows join, share access)
OK - ucs-test samba4

OK - YAML

Comment 6 Janek Walkenhorst

2016-03-08 18:00:48 CET

<http://errata.software-univention.de/ucs/3.2/408.html>