samba announce - Jun 2014 - [Announce] Samba 4.1.9, 4.0.19 and 3.6.24 Security Releases Available

Release Announcements
---------------------

Samba 4.1.9, 4.0.19 and 3.6.24 have been issued as security releases in order
to address CVE-2014-0244 (Denial of service - CPU loop) and
CVE-2014-3493 (Denial of service - Server crash/memory corruption).

For more details/patches, please see
  http://www.samba.org/samba/history/security.html


o  CVE-2014-0244:
   All current released versions of Samba are vulnerable to a denial of
   service on the nmbd NetBIOS name services daemon. A malformed packet
   can cause the nmbd server to loop the CPU and prevent any further
   NetBIOS name service.

   This flaw is not exploitable beyond causing the code to loop
   expending CPU resources.


o  CVE-2014-3493:
   All current released versions of Samba are vulnerable to a denial of
   service on the smbd file server daemon.

   Valid unicode path names stored on disk can cause smbd to
   crash if an authenticated client attempts to read them
   using a non-unicode request.

   The crash is caused by memory being overwritten by
   zeros at a 4GB offset from the expected return buffer
   area, due to an invalid return code from a bad unicode
   to Windows character set conversion.

   Currently it is not believed to be exploitable by
   an attacker, as there is no way to control the
   exact area of memory being overwritten. However,
   in the interests of safety this is being treated


Changes:
=======
o   Jeremy Allison <jra at samba.org>
    * BUG 10633: CVE-2014-0244: Fix nmbd denial of service.
    * BUG 10654: CVE-2014-3493: Fix segmentation fault in
      smbd_marshall_dir_entry()'s SMB_FIND_FILE_UNIX handler.


#######################################
Reporting bugs & Development Discussion
#######################################

Please discuss this release on the samba-technical mailing list or by
joining the #samba-technical IRC channel on irc.freenode.net.

If you do report problems then please try to send high quality
feedback. If you don't provide vital information to help us track down
the problem then you will probably be ignored.  All bug reports should
be filed under the Samba correct product in the project's Bugzilla
database (https://bugzilla.samba.org/).


======================================================================= Our
Code, Our Bugs, Our Responsibility.
== The Samba Team
=====================================================================
===============Download Details
===============
The uncompressed tarballs and patch files have been signed
using GnuPG (ID 6568B7EA).  The source code can be downloaded
from:

        http://download.samba.org/samba/ftp/stable/

The release notes are available online at:

	http://www.samba.org/samba/history/samba-4.1.9.html
	http://www.samba.org/samba/history/samba-4.0.19.html
	http://www.samba.org/samba/history/samba-3.6.24.html

Binary packages will be made available on a volunteer basis from

        http://download.samba.org/samba/ftp/Binary_Packages/

Our Code, Our Bugs, Our Responsibility.
(https://bugzilla.samba.org/)

                        --Enjoy
                        The Samba Team