Samba 4.18 Features added/changed

Samba 4.18 is Current Stable Release.

Samba 4.18.5

Release Notes for Samba 4.18.5

July 19, 2023

This is a security release in order to address the following defects:

• CVE-2022-2127

When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it.

• CVE-2023-3347

SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory.

• CVE-2023-34966

An infinite loop bug in Samba's mdssvc RPC service for Spotlight can be triggered by an unauthenticated attacker by issuing a malformed RPC request.

• CVE-2023-34967

Missing type validation in Samba's mdssvc RPC service for Spotlight can be used by an unauthenticated attacker to trigger a process crash in a shared RPC mdssvc worker process.

• CVE-2023-34968

As part of the Spotlight protocol Samba discloses the server-side absolute path of shares and files and directories in search results.

Changes since 4.18.4

• Ralph Boehme <slow@samba.org>

• BUG 15072: CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send.
• BUG 15340: CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop.
• BUG 15341: CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion.
• BUG 15388: CVE-2023-34968: Spotlight server-side Share Path Disclosure.
• BUG 15397: CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set.

• Samuel Cabrero <scabrero@samba.org>

• BUG 15072: CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send.

• Volker Lendecke <vl@samba.org>

• BUG 15072: CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send.

• Stefan Metzmacher <metze@samba.org>

• BUG 15418: Secure channel faulty since Windows 10/11 update 07/2023.

Release Notes Samba 4.18.5

Samba 4.18.4

Release Notes for Samba 4.18.4

July 05, 2023

Changes since 4.18.3

• Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

• BUG 15404: Backport --pidl-developer fixes.

• Samuel Cabrero <scabrero@samba.org>

• BUG 14030: Named crashes on DLZ zone update.

• Björn Jacke <bj@sernet.de>

• BUG 2312: smbcacls and smbcquotas do not check // before the server.

• Volker Lendecke <vl@samba.org>

• BUG 15382: cli_list loops 100% CPU against pre-lanman2 servers.
• BUG 15391: smbclient leaks fds with showacls.
• BUG 15402: smbd returns NOT_FOUND when creating files on a r/o filesystem.

• Stefan Metzmacher <metze@samba.org>

• BUG 15355: NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry and causes test timeouts.

• Noel Power <noel.power@suse.com>

• BUG 15384: net ads lookup (with unspecified realm) fails.

• Christof Schmitt <cs@samba.org>

• BUG 15381: Register Samba processes with GPFS.

• Andreas Schneider <asn@samba.org>

• BUG 15390: Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation).
• BUG 15398: The winbind child segfaults when listing users with `winbind scan trusted domains = yes`.

• Jones Syue <jonessyue@qnap.com>

• BUG 15383: Remove comments about deprecated 'write cache size'.
• BUG 15403: smbget memory leak if failed to download files recursively.

Release Notes Samba 4.18.4

Samba 4.18.3

Release Notes for Samba 4.18.3

May 31, 2023

Changes since 4.18.2

• Ralph Boehme <slow@samba.org>

• BUG 15375: Symlinks to files can have random DOS mode information in a directory listing.
• BUG 15378: vfs_fruit might cause a failing open for delete.

• Volker Lendecke <vl@samba.org>

• BUG 15361: winbind recurses into itself via rpcd_lsad.
• BUG 15366: wbinfo -u fails on ad dc with >1000 users.

• Stefan Metzmacher <metze@samba.org>

• BUG 15338: DS ACEs might be inherited to unrelated object classes.
• BUG 15362: a lot of messages: get_static_share_mode_data: get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND.
• BUG 15374: aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse().

• Andreas Schneider <asn@samba.org>

• BUG 15360: Setting veto files = /.*/ break listing directories.

• Joseph Sutton <josephsutton@catalyst.net.nz>

• BUG 15363: "samba-tool domain provision" does not run interactive mode if no arguments are given.

• Nathaniel W. Turner <nturner@exagrid.com>

• BUG 15325: dsgetdcname: assumes local system uses IPv4.

 Release Notes Samba 4.18.3

Samba 4.18.2

Release Notes for Samba 4.18.2

April 19, 2023

Changes since 4.18.1

• Jeremy Allison <jra@samba.org>

• BUG 15302: Log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower.
• BUG 15306: Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c.

• Andrew Bartlett <abartlet@samba.org>

• BUG 15328: test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners.
• BUG 15329: Reduce flapping of ridalloc test.
• BUG 15351: large_ldap test is unreliable.

• Ralph Boehme <slow@samba.org>

• BUG 15143: New filename parser doesn't check veto files smb.conf parameter.
• BUG 15354: mdssvc may crash when initializing.

• Volker Lendecke <vl@samba.org>

• BUG 15313: large directory optimization broken for non-lcomp path elements.
• BUG 15357: streams_depot fails to create streams.
• BUG 15358: shadow_copy2 and streams_depot don't play well together.

• Rob van der Linde <rob@catalyst.net.nz>

• BUG 15316: Flapping tests in samba_tool_drs_show_repl.py.

• Stefan Metzmacher <metze@samba.org>

• BUG 15317: winbindd idmap child contacts the domain controller without a need.
• BUG 15318: idmap_autorid may fail to map sids of trusted domains for the first time.
• BUG 15319: idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings.
• BUG 15323: net ads search -P doesn't work against servers in other domains.
• BUG 15353: Temporary smbXsrv_tcon_global.tdb can't be parsed.

• Joseph Sutton <josephsutton@catalyst.net.nz>

• BUG 15316: Flapping tests in samba_tool_drs_show_repl.py.
• BUG 15343: Tests use depricated and removed methods like assertRegexpMatches.

 Release Notes Samba 4.18.2

Samba 4.18.1

Release Notes for Samba 4.18.1

March 29, 2023

This is a security release in order to address the following defects:

• CVE-2023-0922

The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection.

• CVE-2023-0614

The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure via LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. Installations with such secrets in their Samba AD should assume they have been obtained and need replacing.

Changes since 4.18.0

• Andrew Bartlett <abartlet@samba.org>

• BUG 15270: CVE-2023-0614.
• BUG 15331: ldb wildcard matching makes excessive allocations.
• BUG 15332: large_ldap test is inefficient.

• Rob van der Linde <rob@catalyst.net.nz>

• BUG 15315: CVE-2023-0922.

• Joseph Sutton <josephsutton@catalyst.net.nz>

• BUG 15270: CVE-2023-0614
• BUG 15276: CVE-2023-0922

 Release Notes Samba 4.18.1

Samba 4.18.0

Release Announcements

Release Notes for 4.18.0

March 8, 2023

This is the first stable release of the Samba 4.18 release series. Please read the release notes carefully before upgrading.

NEW FEATURES/CHANGES

SMB Server performance improvements

The security improvements in recent releases (4.13, 4.14, 4.15, 4.16), mainly as protection against symlink races, caused performance regressions for metadata heavy workloads.

While 4.17 already improved the situation quite a lot, with 4.18 the locking overhead for contended path based operations is reduced by an additional factor of ~ 3 compared to 4.17. It means the throughput of open/close operations reached the level of 4.12 again.

More succinct samba-tool error messages

Historically samba-tool has reported user error or misconfiguration by means of a Python traceback, showing you where in its code it noticed something was wrong, but not always exactly what is amiss. Now it tries harder to identify the true cause and restrict its output to describing that. Particular cases include:

• a username or password is incorrect
• an ldb database filename is wrong (including in smb.conf)
• samba-tool dns: various zones or records do not exist
• samba-tool ntacl: certain files are missing
• the network seems to be down
• bad --realm or --debug arguments

Accessing the old samba-tool messages

This is not new, but users are reminded they can get the full Python stack trace, along with other noise, by using the argument '-d3'. This may be useful when searching the web.

The intention is that when samba-tool encounters an unrecognised problem (especially a bug), it will still output a Python traceback. If you encounter a problem that has been incorrectly identified by samba-tool, please report it on https://bugzilla.samba.org.

Colour output with samba-tool --color

For some time a few samba-tool commands have had a --color=yes|no|auto option, which determines whether the command outputs ANSI colour codes. Now all samba-tool commands support this option, which now also accepts 'always' and 'force' for 'yes', 'never' and 'none' for 'no', and 'tty' and 'if-tty' for 'auto' (this more closely matches convention). With --color=auto, or when --color is omitted, colour codes are only used when output is directed to a terminal.

Most commands have very little colour in any case. For those that already used it, the defaults have changed slightly.

• samba-tool drs showrepl: default is now 'auto', not 'no'
• samba-tool visualize: the interactions between --color-scheme, --color, and --output have changed slightly. When --color-scheme is set it overrides --color for the purpose of the output diagram, but not for other output like error messages.

No colour with NO_COLOR environment variable

With both samba-tool --color=auto (see above) and some other places where we use ANSI colour codes, the NO_COLOR environment variable will disable colour output. See https://no-color.org/ for a description of this variable. `samba-tool --color=always` will use colour regardless of NO_COLOR.

New wbinfo option --change-secret-at

The wbinfo command has a new option, --change-secret-at=<DOMAIN CONTROLLER> which forces the trust account password to be changed at a specified domain controller. If the specified domain controller cannot be contacted the password change fails rather than trying other DCs.

New option to change the NT ACL default location

Usually the NT ACLs are stored in the security.NTACL extended attribute (xattr) of files and directories. The new "acl_xattr:security_acl_name" option allows to redefine the default location. The default "security.NTACL" is a protected location, which means the content of the security.NTACL attribute is not accessible from normal users outside of Samba. When this option is set to use a user-defined value, e.g. user.NTACL then any user can potentially access and overwrite this information. The module prevents access to this xattr over SMB, but the xattr may still be accessed by other means (eg local access, SSH, NFS). This option must only be used when this consequence is clearly understood and when specific precautions are taken to avoid compromising the ACL content.

Azure Active Directory / Office365 synchronisation improvements

Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment.

smb.conf changes

 Parameter Name                          Description     Default
 --------------                          -----------     -------
 acl_xattr:security_acl_name             New             security.NTACL
 server addresses                        New

CHANGES SINCE 4.18.0rc4

• Jeremy Allison <jra@samba.org>

• BUG 15314: streams_xattr is creating unexpected locks on folders.

• Volker Lendecke <vl@samba.org>

• BUG 15310: New samba-dcerpc architecture does not scale gracefully.

CHANGES SINCE 4.18.0rc3

• Andreas Schneider <asn@samba.org>

• BUG 15308BUG 15308: Avoid that tests fail because other tests didn't do cleanup on failure.

• baixiangcpp <baixiangcpp@gmail.com>

• BUG 15311BUG 15311: fd_load() function implicitly closes the fd where it should not.

CHANGES SINCE 4.18.0rc2

• Jeremy Allison <jra@samba.org>

• BUG 15301: Improve file_modtime() and issues around smb3 unix test.

• Ralph Boehme <slow@samba.org>

• BUG 15299: Spotlight doesn't work with latest macOS Ventura.

• Stefan Metzmacher <metze@samba.org>

• BUG 15298: Build failure on solaris with tevent 0.14.0 (and ldb 2.7.0). (tevent 0.14.1 and ldb 2.7.1 are already released...)

• John Mulligan <jmulligan@redhat.com>

• BUG 15307: vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat.

• Andreas Schneider <asn@samba.org>

• BUG 15291: test_chdir_cache.sh doesn't work with SMBD_DONT_LOG_STDOUT=1.
• BUG 15301: Improve file_modtime() and issues around smb3 unix test.

CHANGES SINCE 4.18.0rc1

• Andrew Bartlett <abartlet@samba.org>

• BUG 10635: Office365 azure Password Sync not working.

• Stefan Metzmacher <metze@samba.org>

• BUG 15286: auth3_generate_session_info_pac leaks wbcAuthUserInfo.

• Noel Power <noel.power@suse.com>

• BUG 15293: With clustering enabled samba-bgqd can core dump due to use after free.

KNOWN ISSUES

Release_Planning_for_Samba_4.18#Release_blocking_bugs

 Release Notes Samba 4.18.0