samba-4.19.1

[Douglas R. Reno]

New point version

[Xi Ruoyao]

This is a security release in order to address the following defects:

• CVE-2023-3961: Unsanitized pipe names allow SMB clients to connect as root to existing unix domain sockets on the file system. ​https://www.samba.org/samba/security/CVE-2023-3961.html

• CVE-2023-4091: SMB client can truncate files to 0 bytes by opening files with OVERWRITE disposition when using the acl_xattr Samba VFS module with the smb.conf setting "acl_xattr:ignore system acls = yes". ​https://www.samba.org/samba/security/CVE-2023-4091.html

• CVE-2023-4154: An RODC and a user with the GET_CHANGES right can view all attributes, including secrets and passwords. Additionally, the access check fails open on error conditions. ​https://www.samba.org/samba/security/CVE-2023-4154.html

• CVE-2023-42669: Calls to the rpcecho server on the AD DC can request that the server block for a user-defined amount of time, denying service. ​https://www.samba.org/samba/security/CVE-2023-42669.html

• CVE-2023-42670: Samba can be made to start multiple incompatible RPC listeners, disrupting service on the AD DC. ​https://www.samba.org/samba/security/CVE-2023-42670.html

Changes since 4.19.0

o Jeremy Allison <jra@…>

• BUG 15422: CVE-2023-3961.

o Andrew Bartlett <abartlet@…>

• BUG 15424: CVE-2023-4154.
• BUG 15473: CVE-2023-42670.
• BUG 15474: CVE-2023-42669.

o Ralph Boehme <slow@…>

• BUG 15439: CVE-2023-4091.

[Tim Tassonis]

Fixed in commit 418edc0647