Blog

SerNet has two important pieces of news about sambaXP, which is scheduled to take place from 31 May to 2 June. First: Due to the still dynamic Corona situation, sambaXP will again happen online. This – our second announcement – makes participation free of charge, tickets can already be booked via the conference website https://sambaxp.org. The call for papers will run until the end of February – we will then publish the programme promptly.

The sambaXP 2022 is sponsored by Google, Microsoft and SerNet.

New SAMBA+ 4.15.5, 4.14.12 and 4.13.17 packages have just been released by SerNet. These are important security releases, please update affected systems as soon as possible. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX.

The packages address the following issues:

• CVE-2021-44141: Information leak via symlinks of existence of files or directories outside of the exported share.
• CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution.
• CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services.

Details are listed in the respective release notes for Samba 4.15.5, 4.14.12 and 4.13.17.

SAMBA+ packages are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.

SAMBA+ 4.15.4 has just been released. Packages for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX are available now.

For the ARM platform, SerNet has already offered packages for Debian-based distributions, and now RPMs for RHEL 8-based distributions are also available for the ARM64/aarch64 platform.

These  updates address several issues, which are listed in the release notes for Samba 4.15.4.

Additionally the following issues are addressed in the SAMBA+ packages:

• Bug 14867: printing fixes after the MS KB5006670 fixes

SAMBA+ packages are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.

SAMBA+ 4.13.16 has just been released. This is a security release that addresses CVE-2021-43566. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX.

All versions of the Samba file server prior to 4.15.0 are affected by CVE-2021-20316. Samba versions prior to 4.15.0 cannot be patched.

• CVE-2021-43566: Symlink race error can allow directory creation outside of the exported share.
  https://www.samba.org/samba/security/CVE-2021-43566.html
• CVE-2021-20316: Symlink race error can allow metadata read and modify outside of the exported share.
  https://www.samba.org/samba/security/CVE-2021-20316.html

Please update affected systems as soon as possible. If possible upgrade to SAMBA+ 4.15, otherwise consult the release notes for possible mitigations for CVE-2021-20316.

SAMBA+ packages are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.

The Samba Team at SerNet published SAMBA+ 4.14.11 and 4.13.15. Packages for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX are available now.

These packages address several issues, which are listed in the release notes:

•   https://www.samba.org/samba/history/samba-4.14.11.html
•   https://www.samba.org/samba/history/samba-4.13.15.html

Please note that the 'username map [script]' workaround, which was required for some setups after the release of 4.14.10 and 4.13.14
(CVE-2020-25717), is not required anymore. Detailed information is included in the CVE-2020-25717 announcement.

SAMBA+ packages and all later versions are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.