Blog

SAMBA+ 4.12.8 and 4.11.14 have just been released. Packages for various SUSE and Red Hat platforms as well as for Debian GNU/Linux and Ubuntu are available now.

These packages address a lot of issues, which are listed in the release notes for Samba 4.12.8 and Samba 4.11.14.

SAMBA+ packages and all later versions are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.

SAMBA+ 4.12.7, 4.11.13 and 4.10.18 packages have just been released by SerNet. These are important security releases addressing "ZeroLogon". Please update affected systems as soon as possible. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux, Ubuntu and AIX.

The packages address the following issue:

• CVE-2020-1472 Unauthenticated domain takeover via netlogon ("ZeroLogon")
  An unauthenticated attacker on the network can gain administrator access by exploiting a netlogon protocol flaw.
  https://www.samba.org/samba/security/CVE-2020-1472.html

The new SAMBA+ 4.12.7 packages do also address the following issue:

• Bug 14399 Server RAM filling up when writing to share from macOS
  https://bugzilla.samba.org/show_bug.cgi?id=14399

The sernet-samba rpm packages are signed with SerNet's gpg build key to guarantee authenticity. If you have installed the sernet-build-key-1.4-8 key package, the verification might fail due to an rpm issue. After installing the new version sernet-build-key-1.4-9, the issue needs to be fixed manually.

If you are affected, please first remove the SerNet Samba keys from the rpm keyring with the following command:
# rpm --allmatches -e gpg-pubkey-f4428b1a
# rpm --allmatches -e gpg-pubkey-1b6d0337

Afterwards use the following command to import the key into the rpm keyring:
# rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-SerNet-Samba-Team-F4428B1A \
    /etc/pki/rpm-gpg/RPM-GPG-KEY-SerNet-Samba-Team-1B6D0337

SAMBA+ packages are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.

SAMBA+ 4.12.6 has just been released. Packages for various SUSE and Red Hat platforms as well as for Debian GNU/Linux and Ubuntu are available now.

These packages address a lot of issues, which are listed in the Samba 4.12.6 release notes.

SAMBA+ packages and all later versions are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.

SAMBA+ 4.12.5 has just been released. Packages for various SUSE and Red Hat platforms as well as for Debian GNU/Linux and Ubuntu are available now.

These packages address a lot of issues, which are listed in the Samba 4.12.5 release notes.

Additionally fixes for the following issues are included:

• Bug 14426: log level for debug classes is ignored

• Bug 14427: vfs_ChDir() may not set conn->cwd_fsp->fh->fd = AT_FDCWD

• Bug 14428: PANIC: assert failed in get_lease_type()

SAMBA+ packages and all later versions are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.

SAMBA+ 4.12.4, 4.11.11 and 4.10.17 packages have just been released by SerNet. These are important security releases, please update affected systems as soon as possible. The packages are available for various SUSE and Red Hat platforms as well as for Debian GNU/Linux and Ubuntu.

The packages address the following issues:

• CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results.

  A client combining the 'ASQ' and 'VLV' LDAP controls can cause a NULL pointer de-reference and further combinations with the LDAP paged_results feature can give a use-after-free in Samba's AD DC LDAP server.

• CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU.

  Compression of replies to NetBIOS over TCP/IP name resolution and DNS packets (which can be supplied as UDP requests) can be abused to consume excessive amounts of CPU on the Samba AD DC (only).

• CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV.

  The use of the paged_results or VLV controls against the Global Catalog LDAP server on the AD DC will cause a use-after-free.

• CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd.

  The AD DC NBT server in Samba 4.0 will enter a CPU spin and not process further requests once it receives an empty (zero-length) UDP packet to port 137.

SAMBA+ 4.12.5 packages will be available soon.

SAMBA+ packages and all later versions are available as software subscription. They can be purchased at the SAMBA+ shop, detailed information and prices are listed at https://shop.samba.plus. The subscriptions are managed at our platform OPOSSO (https://oposso.samba.plus). Users can activate their subscriptions here and manage access credentials. The new SAMBA+ packages are included in existing subscriptions.