Files samba-2.2.11/examples/validchars/validchr.com and samba-2.2.12/examples/validchars/validchr.com differ diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/Caldera/OpenLinux/makerpms.sh samba-2.2.12/packaging/Caldera/OpenLinux/makerpms.sh --- samba-2.2.11/packaging/Caldera/OpenLinux/makerpms.sh 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/Caldera/OpenLinux/makerpms.sh 2004-09-29 12:51:25.590924000 -0500 @@ -24,11 +24,11 @@ # Start preparing the packages... if [ $devel -ne 0 ]; then - ( cd ../../../.. ; chown -R ${USERID}.${GRPID} samba; mv samba samba-2.2.11 ) - ( cd ../../../.. ; tar czvf ${SRCDIR}/samba-2.2.11.tar.gz samba-2.2.11; mv samba-2.2.11 samba ) + ( cd ../../../.. ; chown -R ${USERID}.${GRPID} samba; mv samba samba-2.2.12 ) + ( cd ../../../.. ; tar czvf ${SRCDIR}/samba-2.2.12.tar.gz samba-2.2.12; mv samba-2.2.12 samba ) else - ( cd ../../../.. ; chown -R ${USERID}.${GRPID} samba-2.2.11 ) - ( cd ../../../.. ; tar czvf ${SRCDIR}/samba-2.2.11.tar.gz samba-2.2.11 ) + ( cd ../../../.. ; chown -R ${USERID}.${GRPID} samba-2.2.12 ) + ( cd ../../../.. ; tar czvf ${SRCDIR}/samba-2.2.12.tar.gz samba-2.2.12 ) fi cp -af *.spec *.spec-lsb $SPECDIR diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/Caldera/OpenLinux/samba2.spec samba-2.2.12/packaging/Caldera/OpenLinux/samba2.spec --- samba-2.2.11/packaging/Caldera/OpenLinux/samba2.spec 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/Caldera/OpenLinux/samba2.spec 2004-09-29 12:51:25.795893000 -0500 @@ -1,4 +1,4 @@ -%define Version 2.2.11 +%define Version 2.2.12 %define date 1 %define Vendor Caldera %define Dist OpenLinux diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/Caldera/OpenLinux/samba2.spec-lsb samba-2.2.12/packaging/Caldera/OpenLinux/samba2.spec-lsb --- samba-2.2.11/packaging/Caldera/OpenLinux/samba2.spec-lsb 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/Caldera/OpenLinux/samba2.spec-lsb 2004-09-29 12:51:25.602922000 -0500 @@ -1,4 +1,4 @@ -%define Version 2.2.11 +%define Version 2.2.12 %define date 1 %define Vendor Caldera %define Dist OpenLinux diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/Caldera/OpenLinux/samba2.spec-sam samba-2.2.12/packaging/Caldera/OpenLinux/samba2.spec-sam --- samba-2.2.11/packaging/Caldera/OpenLinux/samba2.spec-sam 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/Caldera/OpenLinux/samba2.spec-sam 2004-09-29 12:51:25.671912000 -0500 @@ -1,4 +1,4 @@ -%define Version 2.2.11sam +%define Version 2.2.12sam %define date 1 %define Vendor Caldera %define Dist OpenLinux diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/Caldera/OpenLinux/samba2.spec-team samba-2.2.12/packaging/Caldera/OpenLinux/samba2.spec-team --- samba-2.2.11/packaging/Caldera/OpenLinux/samba2.spec-team 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/Caldera/OpenLinux/samba2.spec-team 2004-09-29 12:51:25.733902000 -0500 @@ -1,4 +1,4 @@ -%define Version 2.2.11 +%define Version 2.2.12 %define date 1 %define Vendor Caldera %define Dist OpenLinux diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/Mandrake/makerpms.sh samba-2.2.12/packaging/Mandrake/makerpms.sh --- samba-2.2.11/packaging/Mandrake/makerpms.sh 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/Mandrake/makerpms.sh 2004-09-29 12:51:25.923874000 -0500 @@ -20,7 +20,7 @@ USERID=`id -u` GRPID=`id -g` -VERSION='2.2.11' +VERSION='2.2.12' RPMVER=`rpm --version | awk '{print $3}'` echo The RPM Version on this machine is: $RPMVER diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/Mandrake/samba2.spec samba-2.2.12/packaging/Mandrake/samba2.spec --- samba-2.2.11/packaging/Mandrake/samba2.spec 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/Mandrake/samba2.spec 2004-09-29 12:51:25.984864000 -0500 @@ -3,7 +3,7 @@ %define vscanver 0.3.1 # 2.2.4 and 1 replace by samba-team at release -%define pversion 2.2.11 +%define pversion 2.2.12 %define prelease 1 # For testing this setup: #%define pversion1 2.2.5 diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/PHT/TurboLinux/makerpms.sh samba-2.2.12/packaging/PHT/TurboLinux/makerpms.sh --- samba-2.2.11/packaging/PHT/TurboLinux/makerpms.sh 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/PHT/TurboLinux/makerpms.sh 2004-09-29 12:51:25.850885000 -0500 @@ -6,8 +6,8 @@ USERID=`id -u` GRPID=`id -g` -( cd ../../../.. ; chown -R ${USERID}.${GRPID} ${SRCDIR}/samba-2.2.11 ) -( cd ../../../.. ; tar czvf ${SRCDIR}/samba-2.2.11.tar.gz samba-2.2.11 ) +( cd ../../../.. ; chown -R ${USERID}.${GRPID} ${SRCDIR}/samba-2.2.12 ) +( cd ../../../.. ; tar czvf ${SRCDIR}/samba-2.2.12.tar.gz samba-2.2.12 ) cp -a *.spec $SPECDIR cp -a *.patch smb.* samba.log $SRCDIR cd $SPECDIR diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/PHT/TurboLinux/samba2.spec samba-2.2.12/packaging/PHT/TurboLinux/samba2.spec --- samba-2.2.11/packaging/PHT/TurboLinux/samba2.spec 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/PHT/TurboLinux/samba2.spec 2004-09-29 12:51:25.863883000 -0500 @@ -1,10 +1,10 @@ Summary: Samba SMB client and server Name: samba -Version: 2.2.11 +Version: 2.2.12 Release: 1 Copyright: GNU GPL version 2 Group: Networking -Source: ftp://samba.org/pub/samba/samba-2.2.11.tar.gz +Source: ftp://samba.org/pub/samba/samba-2.2.12.tar.gz Patch: smbw.patch Requires: pam >= 0.64 kernel >= 2.2.1 glibc >= 2.1.2 Prereq: chkconfig fileutils @@ -12,7 +12,7 @@ Prefix: /usr %package -n smbfs -Version: 2.2.11 +Version: 2.2.12 Release: 1 Group: Utilities/File Summary: Programs to mount SMB shares. diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/RedHat/makerpms.sh samba-2.2.12/packaging/RedHat/makerpms.sh --- samba-2.2.11/packaging/RedHat/makerpms.sh 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/RedHat/makerpms.sh 2004-09-29 12:51:25.994863000 -0500 @@ -27,7 +27,7 @@ USERID=`id -u` GRPID=`id -g` -VERSION='2.2.11' +VERSION='2.2.12' RPMVER=`rpm --version | awk '{print $3}'` RPM="rpm" diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/RedHat/samba2-devel.spec samba-2.2.12/packaging/RedHat/samba2-devel.spec --- samba-2.2.11/packaging/RedHat/samba2-devel.spec 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/RedHat/samba2-devel.spec 2004-09-29 12:51:26.006861000 -0500 @@ -1,6 +1,6 @@ Summary: Samba SMB client and server Name: samba -Version: 2.2.11 +Version: 2.2.12 Release: 1 Copyright: GNU GPL version 2 Group: Networking diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/packaging/RedHat/samba2.spec samba-2.2.12/packaging/RedHat/samba2.spec --- samba-2.2.11/packaging/RedHat/samba2.spec 2004-08-12 19:31:12.000000000 -0500 +++ samba-2.2.12/packaging/RedHat/samba2.spec 2004-09-29 12:51:26.060853000 -0500 @@ -1,6 +1,6 @@ Summary: Samba SMB client and server Name: samba -Version: 2.2.11 +Version: 2.2.12 Release: 1 Copyright: GNU GPL version 2 Group: Networking diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/REVISION samba-2.2.12/REVISION --- samba-2.2.11/REVISION 1969-12-31 18:00:00.000000000 -0600 +++ samba-2.2.12/REVISION 2004-09-29 12:51:26.935720000 -0500 @@ -0,0 +1,11 @@ +Path: . +URL: svn+ssh://svn.samba.org/home/svn/samba/branches/SAMBA_2_2_RELEASE +Repository UUID: 0c0555d6-39d7-0310-84fc-f1cc0bd64818 +Revision: 2753 +Node Kind: directory +Schedule: normal +Last Changed Author: jerry +Last Changed Rev: 1797 +Last Changed Date: 2004-08-12 19:25:00 -0500 (Thu, 12 Aug 2004) +Properties Last Updated: 2004-08-12 13:24:59 -0500 (Thu, 12 Aug 2004) + diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/source/include/version.h samba-2.2.12/source/include/version.h --- samba-2.2.11/source/include/version.h 2004-08-12 13:31:57.000000000 -0500 +++ samba-2.2.12/source/include/version.h 2004-09-29 12:37:52.026605000 -0500 @@ -1 +1 @@ -#define VERSION "2.2.11" +#define VERSION "2.2.12" diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/source/smbd/vfs.c samba-2.2.12/source/smbd/vfs.c --- samba-2.2.11/source/smbd/vfs.c 2004-08-12 13:24:21.000000000 -0500 +++ samba-2.2.12/source/smbd/vfs.c 2004-09-29 12:37:44.593735000 -0500 @@ -784,7 +784,6 @@ *dir2 = *wd = *base_name = *newname = 0; if (widelinks) { - unix_clean_name(s); /* can't have a leading .. */ if (strncmp(s,"..",2) == 0 && (s[2]==0 || s[2]=='/')) { DEBUG(3,("Illegal file name? (%s)\n",s)); Files samba-2.2.11/source/utils/smbfilter.c and samba-2.2.12/source/utils/smbfilter.c differ diff -u -r --new-file --exclude .svn --exclude CVS samba-2.2.11/WHATSNEW.txt samba-2.2.12/WHATSNEW.txt --- samba-2.2.11/WHATSNEW.txt 2004-08-12 19:25:33.000000000 -0500 +++ samba-2.2.12/WHATSNEW.txt 2004-09-29 12:37:44.696719000 -0500 @@ -1,4 +1,65 @@ ============================== + Release Notes for Samba 2.2.12 + Sept 29, 2004 + ============================== + + +######################## SECURITY RELEASE ######################## + +Summary: Potential Arbitrary File Access + +Affected +Versions: Samba 2.2.x + +Summary: A remote attacker may be able to gain access + to files which exist outside of the share's + defined path. Such files must still be readable + by the account used for the connection. + +CVE ID: CAN-2004-0815 + (http://cve.mitre.org/) + +This is the last stable release of the Samba 2.2 code base. +There will be no further Samba 2.2.x releases. + +------------- +CAN-2004-0815 +------------- + +A bug in the input validation routines used to convert DOS +path names to path names on the Samba host's file system +may be exploited to gain access to files outside of the +share's path defined by smb.conf. + + +Protecting Unpatched Servers +---------------------------- + +Samba file shares with 'wide links = no' (a non-default +setting) in the service definition in smb.conf are *not* +vulnerable to this attack. + +The Samba Team always encourages users to run the latest stable +release as a defense of against attacks. However, under certain +circumstances it may not be possible to immediately upgrade +important installations. In such cases, administrators should +read the "Server Security" documentation found at +http://www.samba.org/samba/docs/server_security.html. + + +Credits +-------- + +Both security issues were reported to Samba developers by +iDEFENSE (http://www.idefense.com/). Karol Wiesek is +credited with this discovery. + +-- + +Older releases notes for 2.2.x distributions follow + + ------------------------------------------------------ + ============================== Release Notes for Samba 2.2.11 Aug 12, 2004 ============================== @@ -17,8 +78,6 @@ issuing FindFirstPrintChangeNotify(). -Older releases notes for 2.2.x distributions follow - ------------------------------------------------------ ============================== Release Notes for Samba 2.2.10