For those who have the 3.0.21b or 3.0.21c, Samba
3.0.22 was released as a security update (about a week
ago). (I just saw someone on the centos list with
3.0.21c so i thought I'd post this announcement for
all others.) The downside to getting non-distro
updates from upstream is that you are responsible for
watching out for security releases.
For those with the CentOS version
(samba-3.0.10-1.4E.6) it already includes all
available errata.
Official Announcement from samba.org:-
Security Release: Samba 3.0.22 Available for Download
This is a security release of Samba. The Samba 3.0.21
release series (including the patch releases a through
c) has been discovered to expose the clear text of the
server's machine account credentials in the winbind
log files when the log level is set to 5 or higher.
Details can be found in the online release notes or in
the original security announcement for CAN-2006-1059.
The Samba 3.0.22 source code can be downloaded now.
The GnuPG signature for the uncompressed tarball is
also available. If you prefer to download just the
diff from 3.0.21c to 3.0.22, the patch file (gpg
signature) is also available. Precompiled packages for
Fedora Core 4, RedHat 9, all SuSE Linux products, and
Solaris are available in the Binary_Packages download
area. Packages for other platforms will be available
shortly.
-----------------------------------------------
Improve the mailing list by performing a simple search
before posting and reading the faq/etiquette.
Thank you!!
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
