| blob | 674d70fe8b6f6d8ac10f4a7af413c0f3356ad36b |
1 ===============================
2 Release Notes for Samba 4.17.10
3 July 19, 2023
4 ===============================
7 This is a security release in order to address the following defects:
9 o CVE-2022-2127: When winbind is used for NTLM authentication, a maliciously
10 crafted request can trigger an out-of-bounds read in winbind
11 and possibly crash it.
12 https://www.samba.org/samba/security/CVE-2022-2127.html
14 o CVE-2023-3347: SMB2 packet signing is not enforced if an admin configured
15 "server signing = required" or for SMB2 connections to Domain
16 Controllers where SMB2 packet signing is mandatory.
17 https://www.samba.org/samba/security/CVE-2023-3347.html
19 o CVE-2023-34966: An infinite loop bug in Samba's mdssvc RPC service for
20 Spotlight can be triggered by an unauthenticated attacker by
21 issuing a malformed RPC request.
22 https://www.samba.org/samba/security/CVE-2023-34966.html
24 o CVE-2023-34967: Missing type validation in Samba's mdssvc RPC service for
25 Spotlight can be used by an unauthenticated attacker to
26 trigger a process crash in a shared RPC mdssvc worker process.
27 https://www.samba.org/samba/security/CVE-2023-34967.html
29 o CVE-2023-34968: As part of the Spotlight protocol Samba discloses the server-
30 side absolute path of shares and files and directories in
31 search results.
32 https://www.samba.org/samba/security/CVE-2023-34968.html
35 Changes since 4.17.9
36 --------------------
38 o Ralph Boehme <slow@samba.org>
39 * BUG 15072: CVE-2022-2127.
40 * BUG 15340: CVE-2023-34966.
41 * BUG 15341: CVE-2023-34967.
42 * BUG 15388: CVE-2023-34968.
43 * BUG 15397: CVE-2023-3347.
45 o Volker Lendecke <vl@samba.org>
46 * BUG 15072: CVE-2022-2127.
48 o Stefan Metzmacher <metze@samba.org>
49 * BUG 15418: Secure channel faulty since Windows 10/11 update 07/2023.
52 #######################################
53 Reporting bugs & Development Discussion
54 #######################################
56 Please discuss this release on the samba-technical mailing list or by
57 joining the #samba-technical:matrix.org matrix room, or
58 #samba-technical IRC channel on irc.libera.chat.
60 If you do report problems then please try to send high quality
61 feedback. If you don't provide vital information to help us track down
62 the problem then you will probably be ignored. All bug reports should
63 be filed under the Samba 4.1 and newer product in the project's Bugzilla
64 database (https://bugzilla.samba.org/).
67 ======================================================================
68 == Our Code, Our Bugs, Our Responsibility.
69 == The Samba Team
70 ======================================================================
73 Release notes for older releases follow:
74 ----------------------------------------
75 ==============================
76 Release Notes for Samba 4.17.9
77 July 06, 2023
78 ==============================
81 This is the latest stable release of the Samba 4.17 release series.
84 Changes since 4.17.8
85 --------------------
87 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
88 * BUG 15404: Backport --pidl-developer fixes.
90 o Ralph Boehme <slow@samba.org>
91 * BUG 15275: smbd_scavenger crashes when service smbd is stopped.
92 * BUG 15378: vfs_fruit might cause a failing open for delete.
94 o Samuel Cabrero <scabrero@samba.org>
95 * BUG 14030: named crashes on DLZ zone update.
97 o Volker Lendecke <vl@samba.org>
98 * BUG 15361: winbind recurses into itself via rpcd_lsad.
99 * BUG 15382: cli_list loops 100% CPU against pre-lanman2 servers.
100 * BUG 15391: smbclient leaks fds with showacls.
102 o Stefan Metzmacher <metze@samba.org>
103 * BUG 15374: aes256 smb3 encryption algorithms are not allowed in
104 smb3_sid_parse().
105 * BUG 15413: winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR.
107 o Jones Syue <jonessyue@qnap.com>
108 * BUG 15403: smbget memory leak if failed to download files recursively.
111 #######################################
112 Reporting bugs & Development Discussion
113 #######################################
115 Please discuss this release on the samba-technical mailing list or by
116 joining the #samba-technical:matrix.org matrix room, or
117 #samba-technical IRC channel on irc.libera.chat.
119 If you do report problems then please try to send high quality
120 feedback. If you don't provide vital information to help us track down
121 the problem then you will probably be ignored. All bug reports should
122 be filed under the Samba 4.1 and newer product in the project's Bugzilla
123 database (https://bugzilla.samba.org/).
126 ======================================================================
127 == Our Code, Our Bugs, Our Responsibility.
128 == The Samba Team
129 ======================================================================
132 ----------------------------------------------------------------------
133 ==============================
134 Release Notes for Samba 4.17.8
135 May 11, 2023
136 ==============================
139 This is the latest stable release of the Samba 4.17 release series.
142 Changes since 4.17.7
143 --------------------
145 o Jeremy Allison <jra@samba.org>
146 * BUG 15302: log flood: smbd_calculate_access_mask_fsp: Access denied:
147 message level should be lower.
148 * BUG 15306: Floating point exception (FPE) via cli_pull_send at
149 source3/libsmb/clireadwrite.c.
151 o Andrew Bartlett <abartlet@samba.org>
152 * BUG 15328: test_tstream_more_tcp_user_timeout_spin fails intermittently on
153 Rackspace GitLab runners.
154 * BUG 15329: Reduce flapping of ridalloc test.
155 * BUG 15351: large_ldap test is unreliable.
157 o Ralph Boehme <slow@samba.org>
158 * BUG 15143: New filename parser doesn't check veto files smb.conf parameter.
159 * BUG 15354: mdssvc may crash when initializing.
161 o Volker Lendecke <vl@samba.org>
162 * BUG 15313: Large directory optimization broken for non-lcomp path elements.
163 * BUG 15357: streams_depot fails to create streams.
164 * BUG 15358: shadow_copy2 and streams_depot don't play well together.
165 * BUG 15366: wbinfo -u fails on ad dc with >1000 users.
167 o Stefan Metzmacher <metze@samba.org>
168 * BUG 15317: winbindd idmap child contacts the domain controller without a
169 need.
170 * BUG 15318: idmap_autorid may fail to map sids of trusted domains for the
171 first time.
172 * BUG 15319: idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings.
173 * BUG 15323: net ads search -P doesn't work against servers in other domains.
174 * BUG 15338: DS ACEs might be inherited to unrelated object classes.
175 * BUG 15353: Temporary smbXsrv_tcon_global.tdb can't be parsed.
177 o Andreas Schneider <asn@samba.org>
178 * BUG 15360: Setting veto files = /.*/ break listing directories.
180 o Joseph Sutton <josephsutton@catalyst.net.nz>
181 * BUG 14810: CVE-2020-25720 [SECURITY] Create Child permission should not
182 allow full write to all attributes (additional changes).
183 * BUG 15329: Reduce flapping of ridalloc test.
185 o Nathaniel W. Turner <nturner@exagrid.com>
186 * BUG 15325: dsgetdcname: assumes local system uses IPv4.
189 #######################################
190 Reporting bugs & Development Discussion
191 #######################################
193 Please discuss this release on the samba-technical mailing list or by
194 joining the #samba-technical:matrix.org matrix room, or
195 #samba-technical IRC channel on irc.libera.chat.
197 If you do report problems then please try to send high quality
198 feedback. If you don't provide vital information to help us track down
199 the problem then you will probably be ignored. All bug reports should
200 be filed under the Samba 4.1 and newer product in the project's Bugzilla
201 database (https://bugzilla.samba.org/).
204 ======================================================================
205 == Our Code, Our Bugs, Our Responsibility.
206 == The Samba Team
207 ======================================================================
210 ----------------------------------------------------------------------
211 ==============================
212 Release Notes for Samba 4.17.7
213 March 29, 2023
214 ==============================
217 This is a security release in order to address the following defects:
219 o CVE-2023-0225: An incomplete access check on dnsHostName allows authenticated
220 but otherwise unprivileged users to delete this attribute from
221 any object in the directory.
222 https://www.samba.org/samba/security/CVE-2023-0225.html
224 o CVE-2023-0922: The Samba AD DC administration tool, when operating against a
225 remote LDAP server, will by default send new or reset
226 passwords over a signed-only connection.
227 https://www.samba.org/samba/security/CVE-2023-0922.html
229 o CVE-2023-0614: The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919
230 Confidential attribute disclosure via LDAP filters was
231 insufficient and an attacker may be able to obtain
232 confidential BitLocker recovery keys from a Samba AD DC.
233 Installations with such secrets in their Samba AD should
234 assume they have been obtained and need replacing.
235 https://www.samba.org/samba/security/CVE-2023-0614.html
238 Changes since 4.17.6
239 --------------------
241 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
242 * BUG 15276: CVE-2023-0225.
244 o Andrew Bartlett <abartlet@samba.org>
245 * BUG 15270: CVE-2023-0614.
246 * BUG 15331: ldb wildcard matching makes excessive allocations.
247 * BUG 15332: large_ldap test is inefficient.
249 o Rob van der Linde <rob@catalyst.net.nz>
250 * BUG 15315: CVE-2023-0922.
252 o Joseph Sutton <josephsutton@catalyst.net.nz>
253 * BUG 14810: CVE-2020-25720 [SECURITY] Create Child permission should not
254 allow full write to all attributes (additional changes).
255 * BUG 15270: CVE-2023-0614.
256 * BUG 15276: CVE-2023-0225.
259 #######################################
260 Reporting bugs & Development Discussion
261 #######################################
263 Please discuss this release on the samba-technical mailing list or by
264 joining the #samba-technical:matrix.org matrix room, or
265 #samba-technical IRC channel on irc.libera.chat.
267 If you do report problems then please try to send high quality
268 feedback. If you don't provide vital information to help us track down
269 the problem then you will probably be ignored. All bug reports should
270 be filed under the Samba 4.1 and newer product in the project's Bugzilla
271 database (https://bugzilla.samba.org/).
274 ======================================================================
275 == Our Code, Our Bugs, Our Responsibility.
276 == The Samba Team
277 ======================================================================
280 ----------------------------------------------------------------------
281 ==============================
282 Release Notes for Samba 4.17.6
283 March 09, 2023
284 ==============================
287 This is the latest stable release of the Samba 4.17 release series.
290 Changes since 4.17.5
291 --------------------
293 o Jeremy Allison <jra@samba.org>
294 * BUG 15314: streams_xattr is creating unexpected locks on folders.
296 o Andrew Bartlett <abartlet@samba.org>
297 * BUG 10635: Use of the Azure AD Connect cloud sync tool is now supported for
298 password hash synchronisation, allowing Samba AD Domains to synchronise
299 passwords with this popular cloud environment.
301 o Ralph Boehme <slow@samba.org>
302 * BUG 15299: Spotlight doesn't work with latest macOS Ventura.
304 o Volker Lendecke <vl@samba.org>
305 * BUG 15310: New samba-dcerpc architecture does not scale gracefully.
307 o John Mulligan <jmulligan@redhat.com>
308 * BUG 15307: vfs_ceph incorrectly uses fsp_get_io_fd() instead of
309 fsp_get_pathref_fd() in close and fstat.
311 o Noel Power <noel.power@suse.com>
312 * BUG 15293: With clustering enabled samba-bgqd can core dump due to use
313 after free.
315 o baixiangcpp <baixiangcpp@gmail.com>
316 * BUG 15311: fd_load() function implicitly closes the fd where it should not.
319 #######################################
320 Reporting bugs & Development Discussion
321 #######################################
323 Please discuss this release on the samba-technical mailing list or by
324 joining the #samba-technical:matrix.org matrix room, or
325 #samba-technical IRC channel on irc.libera.chat.
328 If you do report problems then please try to send high quality
329 feedback. If you don't provide vital information to help us track down
330 the problem then you will probably be ignored. All bug reports should
331 be filed under the Samba 4.1 and newer product in the project's Bugzilla
332 database (https://bugzilla.samba.org/).
335 ======================================================================
336 == Our Code, Our Bugs, Our Responsibility.
337 == The Samba Team
338 ======================================================================
341 ----------------------------------------------------------------------
342 ==============================
343 Release Notes for Samba 4.17.5
344 January 26, 2023
345 ==============================
348 This is the latest stable release of the Samba 4.17 release series.
351 Changes since 4.17.4
352 --------------------
354 o Jeremy Allison <jra@samba.org>
355 * BUG 14808: smbc_getxattr() return value is incorrect.
356 * BUG 15172: Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled
357 correctly.
358 * BUG 15210: synthetic_pathref AFP_AfpInfo failed errors.
359 * BUG 15226: samba-tool gpo listall fails IPv6 only - finddcs() fails to find
360 DC when there is only an AAAA record for the DC in DNS.
361 * BUG 15236: smbd crashes if an FSCTL request is done on a stream handle.
362 * BUG 15277: DFS links don't work anymore on Mac clients since 4.17.
363 * BUG 15283: vfs_virusfilter segfault on access, directory edgecase
364 (accessing NULL value).
366 o Samuel Cabrero <scabrero@samba.org>
367 * BUG 15240: CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
368 based SChannel on NETLOGON (additional changes).
370 o Volker Lendecke <vl@samba.org>
371 * BUG 15243: %U for include directive doesn't work for share listing
372 (netshareenum).
373 * BUG 15266: Shares missing from netshareenum response in samba 4.17.4.
374 * BUG 15269: ctdb: use-after-free in run_proc.
376 o Stefan Metzmacher <metze@samba.org>
377 * BUG 15243: %U for include directive doesn't work for share listing
378 (netshareenum).
379 * BUG 15266: Shares missing from netshareenum response in samba 4.17.4.
380 * BUG 15280: irpc_destructor may crash during shutdown.
381 * BUG 15286: auth3_generate_session_info_pac leaks wbcAuthUserInfo.
383 o Andreas Schneider <asn@samba.org>
384 * BUG 15268: smbclient segfaults with use after free on an optimized build.
386 o Jones Syue <jonessyue@qnap.com>
387 * BUG 15282: smbstatus leaking files in msg.sock and msg.lock.
389 o Andrew Walker <awalker@ixsystems.com>
390 * BUG 15164: Leak in wbcCtxPingDc2.
391 * BUG 15265: Access based share enum does not work in Samba 4.16+.
392 * BUG 15267: Crash during share enumeration.
393 * BUG 15271: rep_listxattr on FreeBSD does not properly check for reads off
394 end of returned buffer.
396 o Florian Weimer <fweimer@redhat.com>
397 * BUG 15281: Avoid relying on C89 features in a few places.
400 #######################################
401 Reporting bugs & Development Discussion
402 #######################################
404 Please discuss this release on the samba-technical mailing list or by
405 joining the #samba-technical:matrix.org matrix room, or
406 #samba-technical IRC channel on irc.libera.chat.
409 If you do report problems then please try to send high quality
410 feedback. If you don't provide vital information to help us track down
411 the problem then you will probably be ignored. All bug reports should
412 be filed under the Samba 4.1 and newer product in the project's Bugzilla
413 database (https://bugzilla.samba.org/).
416 ======================================================================
417 == Our Code, Our Bugs, Our Responsibility.
418 == The Samba Team
419 ======================================================================
422 ----------------------------------------------------------------------
423 ==============================
424 Release Notes for Samba 4.17.4
425 December 15, 2022
426 ==============================
429 This is the latest stable release of the Samba 4.17 release series.
430 It also contains security changes in order to address the following defects:
433 o CVE-2022-37966: This is the Samba CVE for the Windows Kerberos
434 RC4-HMAC Elevation of Privilege Vulnerability
435 disclosed by Microsoft on Nov 8 2022.
437 A Samba Active Directory DC will issue weak rc4-hmac
438 session keys for use between modern clients and servers
439 despite all modern Kerberos implementations supporting
440 the aes256-cts-hmac-sha1-96 cipher.
442 On Samba Active Directory DCs and members
443 'kerberos encryption types = legacy' would force
444 rc4-hmac as a client even if the server supports
445 aes128-cts-hmac-sha1-96 and/or aes256-cts-hmac-sha1-96.
447 https://www.samba.org/samba/security/CVE-2022-37966.html
449 o CVE-2022-37967: This is the Samba CVE for the Windows
450 Kerberos Elevation of Privilege Vulnerability
451 disclosed by Microsoft on Nov 8 2022.
453 A service account with the special constrained
454 delegation permission could forge a more powerful
455 ticket than the one it was presented with.
457 https://www.samba.org/samba/security/CVE-2022-37967.html
459 o CVE-2022-38023: The "RC4" protection of the NetLogon Secure channel uses the
460 same algorithms as rc4-hmac cryptography in Kerberos,
461 and so must also be assumed to be weak.
463 https://www.samba.org/samba/security/CVE-2022-38023.html
465 Note that there are several important behavior changes
466 included in this release, which may cause compatibility problems
467 interacting with system still expecting the former behavior.
468 Please read the advisories of CVE-2022-37966,
469 CVE-2022-37967 and CVE-2022-38023 carefully!
471 samba-tool got a new 'domain trust modify' subcommand
472 -----------------------------------------------------
474 This allows "msDS-SupportedEncryptionTypes" to be changed
475 on trustedDomain objects. Even against remote DCs (including Windows)
476 using the --local-dc-ipaddress= (and other --local-dc-* options).
477 See 'samba-tool domain trust modify --help' for further details.
479 smb.conf changes
480 ----------------
482 Parameter Name Description Default
483 -------------- ----------- -------
484 allow nt4 crypto Deprecated no
485 allow nt4 crypto:COMPUTERACCOUNT New
486 kdc default domain supported enctypes New (see manpage)
487 kdc supported enctypes New (see manpage)
488 kdc force enable rc4 weak session keys New No
489 reject md5 clients New Default, Deprecated Yes
490 reject md5 servers New Default, Deprecated Yes
491 server schannel Deprecated Yes
492 server schannel require seal New, Deprecated Yes
493 server schannel require seal:COMPUTERACCOUNT New
494 winbind sealed pipes Deprecated Yes
496 Changes since 4.17.3
497 --------------------
499 o Jeremy Allison <jra@samba.org>
500 * BUG 15224: pam_winbind uses time_t and pointers assuming they are of the
501 same size.
503 o Andrew Bartlett <abartlet@samba.org>
504 * BUG 14929: CVE-2022-44640 [SECURITY] Upstream Heimdal free of
505 user-controlled pointer in FAST.
506 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
507 * BUG 15237: CVE-2022-37966.
508 * BUG 15258: filter-subunit is inefficient with large numbers of knownfails.
510 o Ralph Boehme <slow@samba.org>
511 * BUG 15240: CVE-2022-38023.
512 * BUG 15252: smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories.
514 o Stefan Metzmacher <metze@samba.org>
515 * BUG 13135: The KDC logic arround msDs-supportedEncryptionTypes differs from
516 Windows.
517 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
518 atomically.
519 * BUG 15203: CVE-2022-42898 [SECURITY] krb5_pac_parse() buffer parsing
520 vulnerability.
521 * BUG 15206: libnet: change_password() doesn't work with
522 dcerpc_samr_ChangePasswordUser4().
523 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
524 * BUG 15230: Memory leak in snprintf replacement functions.
525 * BUG 15237: CVE-2022-37966.
526 * BUG 15240: CVE-2022-38023.
527 * BUG 15253: RODC doesn't reset badPwdCount reliable via an RWDC
528 (CVE-2021-20251 regression).
530 o Noel Power <noel.power@suse.com>
531 * BUG 15224: pam_winbind uses time_t and pointers assuming they are of the
532 same size.
534 o Anoop C S <anoopcs@samba.org>
535 * BUG 15198: Prevent EBADF errors with vfs_glusterfs.
537 o Andreas Schneider <asn@samba.org>
538 * BUG 15237: CVE-2022-37966.
539 * BUG 15243: %U for include directive doesn't work for share listing
540 (netshareenum).
541 * BUG 15257: Stack smashing in net offlinejoin requestodj.
543 o Joseph Sutton <josephsutton@catalyst.net.nz>
544 * BUG 15197: Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue.
545 * BUG 15219: Heimdal session key selection in AS-REQ examines wrong entry.
546 * BUG 15231: CVE-2022-37967.
547 * BUG 15237: CVE-2022-37966.
549 o Nicolas Williams <nico@twosigma.com>
550 * BUG 14929: CVE-2022-44640 [SECURITY] Upstream Heimdal free of
551 user-controlled pointer in FAST.
555 #######################################
556 Reporting bugs & Development Discussion
557 #######################################
559 Please discuss this release on the samba-technical mailing list or by
560 joining the #samba-technical:matrix.org matrix room, or
561 #samba-technical IRC channel on irc.libera.chat.
564 If you do report problems then please try to send high quality
565 feedback. If you don't provide vital information to help us track down
566 the problem then you will probably be ignored. All bug reports should
567 be filed under the Samba 4.1 and newer product in the project's Bugzilla
568 database (https://bugzilla.samba.org/).
571 ======================================================================
572 == Our Code, Our Bugs, Our Responsibility.
573 == The Samba Team
574 ======================================================================
577 ----------------------------------------------------------------------
578 ==============================
579 Release Notes for Samba 4.17.3
580 November 15, 2022
581 ==============================
584 This is a security release in order to address the following defects:
587 o CVE-2022-42898: Samba's Kerberos libraries and AD DC failed to guard against
588 integer overflows when parsing a PAC on a 32-bit system, which
589 allowed an attacker with a forged PAC to corrupt the heap.
590 https://www.samba.org/samba/security/CVE-2022-42898.html
592 Changes since 4.17.2
593 --------------------
594 o Joseph Sutton <josephsutton@catalyst.net.nz>
595 * BUG 15203: CVE-2022-42898
597 o Nicolas Williams <nico@twosigma.com>
598 * BUG 15203: CVE-2022-42898
601 #######################################
602 Reporting bugs & Development Discussion
603 #######################################
605 Please discuss this release on the samba-technical mailing list or by
606 joining the #samba-technical:matrix.org matrix room, or
607 #samba-technical IRC channel on irc.libera.chat.
610 If you do report problems then please try to send high quality
611 feedback. If you don't provide vital information to help us track down
612 the problem then you will probably be ignored. All bug reports should
613 be filed under the Samba 4.1 and newer product in the project's Bugzilla
614 database (https://bugzilla.samba.org/).
617 ======================================================================
618 == Our Code, Our Bugs, Our Responsibility.
619 == The Samba Team
620 ======================================================================
623 ----------------------------------------------------------------------
624 ==============================
625 Release Notes for Samba 4.17.2
626 October 25, 2022
627 ==============================
630 This is a security release in order to address the following defects:
632 o CVE-2022-3437: There is a limited write heap buffer overflow in the GSSAPI
633 unwrap_des() and unwrap_des3() routines of Heimdal (included
634 in Samba).
635 https://www.samba.org/samba/security/CVE-2022-3437.html
637 o CVE-2022-3592: A malicious client can use a symlink to escape the exported
638 directory.
639 https://www.samba.org/samba/security/CVE-2022-3592.html
641 Changes since 4.17.1
642 --------------------
644 o Volker Lendecke <vl@samba.org>
645 * BUG 15207: CVE-2022-3592.
647 o Joseph Sutton <josephsutton@catalyst.net.nz>
648 * BUG 15134: CVE-2022-3437.
651 #######################################
652 Reporting bugs & Development Discussion
653 #######################################
655 Please discuss this release on the samba-technical mailing list or by
656 joining the #samba-technical:matrix.org matrix room, or
657 #samba-technical IRC channel on irc.libera.chat.
659 If you do report problems then please try to send high quality
660 feedback. If you don't provide vital information to help us track down
661 the problem then you will probably be ignored. All bug reports should
662 be filed under the Samba 4.1 and newer product in the project's Bugzilla
663 database (https://bugzilla.samba.org/).
666 ======================================================================
667 == Our Code, Our Bugs, Our Responsibility.
668 == The Samba Team
669 ======================================================================
672 ----------------------------------------------------------------------
673 ==============================
674 Release Notes for Samba 4.17.1
675 October 19, 2022
676 ==============================
679 This is the latest stable release of the Samba 4.17 release series.
682 Changes since 4.17.0
683 --------------------
685 o Jeremy Allison <jra@samba.org>
686 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
687 atomically.
688 * BUG 15174: smbXsrv_connection_shutdown_send result leaked.
689 * BUG 15182: Flush on a named stream never completes.
690 * BUG 15195: Permission denied calling SMBC_getatr when file not exists.
692 o Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
693 * BUG 15189: Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
694 over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC.
695 * BUG 15191: pytest: add file removal helpers for TestCaseInTempDir.
697 o Andrew Bartlett <abartlet@samba.org>
698 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
699 atomically.
700 * BUG 15189: Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later.
701 over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC.
703 o Ralph Boehme <slow@samba.org>
704 * BUG 15182: Flush on a named stream never completes.
706 o Volker Lendecke <vl@samba.org>
707 * BUG 15151: vfs_gpfs silently garbles timestamps > year 2106.
709 o Gary Lockyer <gary@catalyst.net.nz>
710 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
711 atomically.
713 o Stefan Metzmacher <metze@samba.org>
714 * BUG 15200: multi-channel socket passing may hit a race if one of the
715 involved processes already existed.
716 * BUG 15201: memory leak on temporary of struct imessaging_post_state and
717 struct tevent_immediate on struct imessaging_context (in
718 rpcd_spoolss and maybe others).
720 o Noel Power <noel.power@suse.com>
721 * BUG 15205: Since popt1.19 various use after free errors using result of
722 poptGetArg are now exposed.
724 o Anoop C S <anoopcs@samba.org>
725 * BUG 15192: Remove special case for O_CREAT in SMB_VFS_OPENAT from
726 vfs_glusterfs.
728 o Andreas Schneider <asn@samba.org>
729 * BUG 15169: GETPWSID in memory cache grows indefinetly with each NTLM auth.
731 o Joseph Sutton <josephsutton@catalyst.net.nz>
732 * BUG 14611: CVE-2021-20251 [SECURITY] Bad password count not incremented
733 atomically.
736 #######################################
737 Reporting bugs & Development Discussion
738 #######################################
740 Please discuss this release on the samba-technical mailing list or by
741 joining the #samba-technical:matrix.org matrix room, or
742 #samba-technical IRC channel on irc.libera.chat.
745 If you do report problems then please try to send high quality
746 feedback. If you don't provide vital information to help us track down
747 the problem then you will probably be ignored. All bug reports should
748 be filed under the Samba 4.1 and newer product in the project's Bugzilla
749 database (https://bugzilla.samba.org/).
752 ======================================================================
753 == Our Code, Our Bugs, Our Responsibility.
754 == The Samba Team
755 ======================================================================
758 ----------------------------------------------------------------------
759 ==============================
760 Release Notes for Samba 4.17.0
761 September 13, 2022
762 ==============================
765 This is the first stable release of the Samba 4.17 release series.
766 Please read the release notes carefully before upgrading.
769 NEW FEATURES/CHANGES
770 ====================
772 SMB Server performance improvements
773 -----------------------------------
775 The security improvements in recent releases
776 (4.13, 4.14, 4.15, 4.16), mainly as protection against symlink races,
777 caused performance regressions for meta data heavy workloads.
779 With 4.17 the situation improved a lot again:
781 - Pathnames given by a client are devided into dirname and basename.
782 The amount of syscalls to validate dirnames is reduced to 2 syscalls
783 (openat, close) per component. On modern Linux kernels (>= 5.6) smbd
784 makes use of the openat2() syscall with RESOLVE_NO_SYMLINKS,
785 in order to just use 2 syscalls (openat2, close) for the whole dirname.
787 - Contended path based operations used to generate a lot of unsolicited
788 wakeup events causing thundering herd problems, which lead to masive
789 latencies for some clients. These events are now avoided in order
790 to provide stable latencies and much higher throughput of open/close
791 operations.
793 Configure without the SMB1 Server
794 ---------------------------------
796 It is now possible to configure Samba without support for
797 the SMB1 protocol in smbd. This can be selected at configure
798 time with either of the options:
800 --with-smb1-server
801 --without-smb1-server
803 By default (without either of these options set) Samba
804 is configured to include SMB1 support (i.e. --with-smb1-server
805 is the default). When Samba is configured without SMB1 support,
806 none of the SMB1 code is included inside smbd except the minimal
807 stub code needed to allow a client to connect as SMB1 and immediately
808 negotiate the selected protocol into SMB2 (as a Windows server also
809 allows).
811 None of the SMB1-only smb.conf parameters are removed when
812 configured without SMB1, but these parameters are ignored by
813 the smbd server. This allows deployment without having to change
814 an existing smb.conf file.
816 This option allows sites, OEMs and integrators to configure Samba
817 to remove the old and insecure SMB1 protocol from their products.
819 Note that the Samba client libraries still support SMB1 connections
820 even when Samba is configured as --without-smb1-server. This is
821 to ensure maximum compatibility with environments containing old
822 SMB1 servers.
824 Bronze bit and S4U support now also with MIT Kerberos 1.20
825 ----------------------------------------------------------
827 In 2020 Microsoft Security Response Team received another Kerberos-related
828 report. Eventually, that led to a security update of the CVE-2020-17049,
829 Kerberos KDC Security Feature Bypass Vulnerability, also known as a ‘Bronze
830 Bit’. With this vulnerability, a compromised service that is configured to use
831 Kerberos constrained delegation feature could tamper with a service ticket that
832 is not valid for delegation to force the KDC to accept it.
834 With the release of MIT Kerberos 1.20, Samba AD DC is able able to mitigate the
835 ‘Bronze Bit’ attack. MIT Kerberos KDC's KDB (Kerberos Database Driver) API was
836 changed to allow passing more details between KDC and KDB components. When built
837 against MIT Kerberos, Samba AD DC supports MIT Kerberos 1.19 and 1.20 versions
838 but 'Bronze Bit' mitigation is provided only with MIT Kerberos 1.20.
840 In addition to fixing the ‘Bronze Bit’ issue, Samba AD DC now fully supports
841 S4U2Self and S4U2Proxy Kerberos extensions.
843 Note the default (Heimdal-based) KDC was already fixed in 2021,
844 see https://bugzilla.samba.org/show_bug.cgi?id=14642
846 Resource Based Constrained Delegation (RBCD) support
847 ----------------------------------------------------
849 Samba AD DC built with MIT Kerberos 1.20 offers RBCD support now. With MIT
850 Kerberos 1.20 we have complete RBCD support passing Sambas S4U testsuite.
852 samba-tool delegation got the 'add-principal' and 'del-principal' subcommands
853 in order to manage RBCD.
855 To complete RBCD support and make it useful to Administrators we added the
856 Asserted Identity [1] SID into the PAC for constrained delegation. This is
857 available for Samba AD compiled with MIT Kerberos 1.20.
859 Note the default (Heimdal-based) KDC does not support RBCD yet.
861 [1] https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview
863 Customizable DNS listening port
864 -------------------------------
866 It is now possible to set a custom listening port for the builtin DNS service,
867 making easy to host another DNS on the same system that would bind to the
868 default port and forward the domain-specific queries to Samba using the custom
869 port. This is the opposite configuration of setting a forwarder in Samba.
871 It makes possible to use another DNS server as a front and forward to Samba.
873 Dynamic DNS updates may not be proxied by the front DNS server when forwarding
874 to Samba. Dynamic DNS update proxying depends on the features of the other DNS
875 server used as a front.
877 CTDB changes
878 ------------
880 * When Samba is configured with both --with-cluster-support and
881 --systemd-install-services then a systemd service file for CTDB will
882 be installed.
884 * ctdbd_wrapper has been removed. ctdbd is now started directly from
885 a systemd service file or init script.
887 * The syntax for the ctdb.tunables configuration file has been
888 relaxed. However, trailing garbage after the value, including
889 comments, is no longer permitted. Please see ctdb-tunables(7) for
890 more details.
892 Operation without the (unsalted) NT password hash
893 -------------------------------------------------
895 When Samba is configured with 'nt hash store = never' then Samba will
896 no longer store the (unsalted) NT password hash for users in Active
897 Directory. (Trust accounts, like computers, domain controllers and
898 inter-domain trusts are not impacted).
900 In the next version of Samba the default for 'nt hash store' will
901 change from 'always' to 'auto', where it will follow (behave as 'nt
902 hash store = never' when 'ntlm auth = disabled' is set.
904 Security-focused deployments of Samba that have eliminated NTLM from
905 their networks will find setting 'ntlm auth = disabled' with 'nt hash
906 store = always' as a useful way to improve compliance with
907 best-practice guidance on password storage (which is to always use an
908 interated hash).
910 Note that when 'nt hash store = never' is set, then arcfour-hmac-md5
911 Kerberos keys will not be available for users who subsequently change
912 their password, as these keys derive their values from NT hashes. AES
913 keys are stored by default for all deployments of Samba with Domain
914 Functional Level 2008 or later, are supported by all modern clients,
915 and are much more secure.
917 Finally, also note that password history in Active Directory is stored
918 in nTPwdHistory using a series of NT hash values. Therefore the full
919 password history feature is not available in this mode.
921 To provide some protection against password re-use previous Kerberos
922 hash values (the current, old and older values are already stored) are
923 used, providing a history length of 3.
925 There is one small limitation of this workaround: Changing the
926 sAMAccountName, userAccountControl or userPrincipalName of an account
927 can cause the Kerberos password salt to change. This means that after
928 *both* an account rename and a password change, only the current
929 password will be recognised for password history purposes.
931 Python API for smbconf
932 ----------------------
934 Samba's smbconf library provides a generic frontend to various
935 configuration backends (plain text file, registry) as a C library. A
936 new Python wrapper, importable as 'samba.smbconf' is available. An
937 additional module, 'samba.samba3.smbconf', is also available to enable
938 registry backend support. These libraries allow Python programs to
939 read, and optionally write, Samba configuration natively.
941 JSON support for smbstatus
942 --------------------------
944 It is now possible to print detailed information in JSON format in
945 the smbstatus program using the new option --json. The JSON output
946 covers all the existing text output including sessions, connections,
947 open files, byte-range locks, notifies and profile data with all
948 low-level information maintained by Samba in the respective databases.
950 Protected Users security group
951 ------------------------------
953 Samba AD DC now includes support for the Protected Users security
954 group introduced in Windows Server 2012 R2. The feature reduces the
955 attack surface of user accounts by preventing the use of weak
956 encryption types. It also mitigates the effects of credential theft by
957 limiting credential lifetime and scope.
959 The protections are intended for user accounts only, and service or
960 computer accounts should not be added to the Protected Users
961 group. User accounts added to the group are granted the following
962 security protections:
964 * NTLM authentication is disabled.
965 * Kerberos ticket-granting tickets (TGTs) encrypted with RC4 are
966 not issued to or accepted from affected principals. Tickets
967 encrypted with AES, and service tickets encrypted with RC4, are
968 not affected by this restriction.
969 * The lifetime of Kerberos TGTs is restricted to a maximum of four
970 hours.
971 * Kerberos constrained and unconstrained delegation is disabled.
973 If the Protected Users group is not already present in the domain, it
974 can be created with 'samba-tool group add'. The new '--special'
975 parameter must be specified, with 'Protected Users' as the name of the
976 group. An example command invocation is:
978 samba-tool group add 'Protected Users' --special
980 or against a remote server:
982 samba-tool group add 'Protected Users' --special -H ldap://dc1.example.com -U Administrator
984 The Protected Users group is identified in the domain by its having a
985 RID of 525. Thus, it should only be created with samba-tool and the
986 '--special' parameter, as above, so that it has the required RID
987 to function correctly.
990 REMOVED FEATURES
991 ================
993 LanMan Authentication and password storage removed from the AD DC
994 -----------------------------------------------------------------
996 The storage and authentication with LanMan passwords has been entirely
997 removed from the Samba AD DC, even when "lanman auth = yes" is set.
1000 smb.conf changes
1001 ================
1003 Parameter Name Description Default
1004 -------------- ----------- -------
1005 dns port New default 53
1006 fruit:zero_file_id New default yes
1007 nt hash store New parameter always
1008 smb1 unix extensions Replaces "unix extensions"
1009 volume serial number New parameter -1
1010 winbind debug traceid New parameter no
1013 CHANGES SINCE 4.17.0rc4
1014 =======================
1016 o Ralph Boehme <slow@samba.org>
1017 * BUG 15126: acl_xattr VFS module may unintentionally use filesystem
1018 permissions instead of ACL from xattr.
1019 * BUG 15153: Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1.
1020 * BUG 15161: assert failed: !is_named_stream(smb_fname)") at
1021 ../../lib/util/fault.c:197.
1023 o Volker Lendecke <vl@samba.org>
1024 * BUG 15126: acl_xattr VFS module may unintentionally use filesystem
1025 permissions instead of ACL from xattr.
1026 * BUG 15161: assert failed: !is_named_stream(smb_fname)") at
1027 ../../lib/util/fault.c:197.
1029 o Stefan Metzmacher <metze@samba.org>
1030 * BUG 15159: Cross-node multi-channel reconnects result in SMB2 Negotiate
1031 returning NT_STATUS_NOT_SUPPORTED.
1033 o Noel Power <noel.power@suse.com>
1034 * BUG 15160: winbind at info level debug can coredump when processing
1035 wb_lookupusergroups.
1038 CHANGES SINCE 4.17.0rc3
1039 =======================
1041 o Anoop C S <anoopcs@samba.org>
1042 * BUG 15157: Make use of glfs_*at() API calls in vfs_glusterfs.
1045 CHANGES SINCE 4.17.0rc2
1046 =======================
1048 o Jeremy Allison <jra@samba.org>
1049 * BUG 15128: Possible use after free of connection_struct when iterating
1050 smbd_server_connection->connections.
1052 o Christian Ambach <ambi@samba.org>
1053 * BUG 15145: `net usershare add` fails with flag works with --long but fails
1054 with -l.
1056 o Ralph Boehme <slow@samba.org>
1057 * BUG 15126: acl_xattr VFS module may unintentionally use filesystem
1058 permissions instead of ACL from xattr.
1060 o Stefan Metzmacher <metze@samba.org>
1061 * BUG 15125: Performance regression on contended path based operations.
1062 * BUG 15148: Missing READ_LEASE break could cause data corruption.
1064 o Andreas Schneider <asn@samba.org>
1065 * BUG 15141: libsamba-errors uses a wrong version number.
1067 o Joseph Sutton <josephsutton@catalyst.net.nz>
1068 * BUG 15152: SMB1 negotiation can fail to handle connection errors.
1071 CHANGES SINCE 4.17.0rc1
1072 =======================
1074 o Jeremy Allison <jra@samba.org>
1075 * BUG 15143: New filename parser doesn't check veto files smb.conf parameter.
1076 * BUG 15144: 4.17.rc1 still uses symlink-race prone unix_convert()
1077 * BUG 15146: Backport fileserver related changed to 4.17.0rc2
1079 o Jule Anger <janger@samba.org>
1080 * BUG 15147: Manpage for smbstatus json is missing
1082 o Volker Lendecke <vl@samba.org>
1083 * BUG 15146: Backport fileserver related changed to 4.17.0rc2
1085 o Stefan Metzmacher <metze@samba.org>
1086 * BUG 15125: Performance regression on contended path based operations
1087 * BUG 15146: Backport fileserver related changed to 4.17.0rc2
1089 o Andreas Schneider <asn@samba.org>
1090 * BUG 15140: Fix issues found by coverity in smbstatus json code
1091 * BUG 15146: Backport fileserver related changed to 4.17.0rc2
1094 KNOWN ISSUES
1095 ============
1097 https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.17#Release_blocking_bugs
1100 #######################################
1101 Reporting bugs & Development Discussion
1102 #######################################
1104 Please discuss this release on the samba-technical mailing list or by
1105 joining the #samba-technical:matrix.org matrix room, or
1106 #samba-technical IRC channel on irc.libera.chat
1108 If you do report problems then please try to send high quality
1109 feedback. If you don't provide vital information to help us track down
1110 the problem then you will probably be ignored. All bug reports should
1111 be filed under the Samba 4.1 and newer product in the project's Bugzilla
1112 database (https://bugzilla.samba.org/).
1115 ======================================================================
1116 == Our Code, Our Bugs, Our Responsibility.
1117 == The Samba Team
1118 ======================================================================