Synopsis:          Moderate: samba4 security, bug fix and enhancement update
Issue Date:        2013-02-21
CVE Numbers:       CVE-2012-1182
--

A flaw was found in the Samba suite's Perl-based DCE/RPC IDL (PIDL) 
compiler,
used to generate code to handle RPC calls. This could result in code 
generated
by the PIDL compiler to not sufficiently protect against buffer overflows.
(CVE-2012-1182)

The samba4 packages have been upgraded to upstream version 4.0.0, which
provides a number of bug fixes and enhancements over the previous 
version. In
particular, improved interoperability with Active Directory (AD) 
domains. SSSD
now uses the libndr-krb5pac library to parse the Privilege Attribute
Certificate (PAC) issued by an AD Key Distribution Center (KDC).

The Cross Realm Kerberos Trust functionality provided by Identity 
Management,
which relies on the capabilities of the samba4 client library, is 
included as a
Technology Preview. This functionality and server libraries, is included 
as a
Technology Preview. This functionality uses the libndr-nbt library to 
prepare
Connection-less Lightweight Directory Access Protocol (CLDAP) messages.

Additionally, various improvements have been made to the Local Security
Authority (LSA) and Net Logon services to allow verification of trust from a
Windows system. Because the Cross Realm Kerberos Trust functionality is
considered a Technology Preview, selected samba4 components are 
considered to
be a Technology Preview. For more information on which Samba packages are
considered a Technology Preview, refer to Table 5.1, "Samba4 Package 
Support"
in the Release Notes, linked to from the References.

This update also fixes the following bug:

* Prior to this update, if the Active Directory (AD) server was rebooted,
Winbind sometimes failed to reconnect when requested by "wbinfo -n" or 
"wbinfo
-s" commands. Consequently, looking up users using the wbinfo tool 
failed. This
update applies upstream patches to fix this problem and now looking up a
Security Identifier (SID) for a username, or a username for a given SID, 
works
as expected after a domain controller is rebooted.

Warning: If you upgrade from Scientific Linux 6.3 to Scientific Linux 
6.4 and
you have Samba in use, you should make sure that you uninstall the package
named "samba4" to avoid conflicts during the upgrade.
--

SL6
   x86_64
     samba4-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-client-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-common-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-dc-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-dc-libs-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-debuginfo-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-devel-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-libs-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-pidl-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-python-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-swat-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-test-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-winbind-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-winbind-clients-4.0.0-55.el6.rc4.x86_64.rpm
     samba4-winbind-krb5-locator-4.0.0-55.el6.rc4.x86_64.rpm
   i386
     samba4-4.0.0-55.el6.rc4.i686.rpm
     samba4-client-4.0.0-55.el6.rc4.i686.rpm
     samba4-common-4.0.0-55.el6.rc4.i686.rpm
     samba4-dc-4.0.0-55.el6.rc4.i686.rpm
     samba4-dc-libs-4.0.0-55.el6.rc4.i686.rpm
     samba4-debuginfo-4.0.0-55.el6.rc4.i686.rpm
     samba4-devel-4.0.0-55.el6.rc4.i686.rpm
     samba4-libs-4.0.0-55.el6.rc4.i686.rpm
     samba4-pidl-4.0.0-55.el6.rc4.i686.rpm
     samba4-python-4.0.0-55.el6.rc4.i686.rpm
     samba4-swat-4.0.0-55.el6.rc4.i686.rpm
     samba4-test-4.0.0-55.el6.rc4.i686.rpm
     samba4-winbind-4.0.0-55.el6.rc4.i686.rpm
     samba4-winbind-clients-4.0.0-55.el6.rc4.i686.rpm
     samba4-winbind-krb5-locator-4.0.0-55.el6.rc4.i686.rpm

The following packages were added for dependency resolution
SL6
   x86_64
     krb5-auth-dialog-0.13-3.el6.x86_64.rpm
     krb5-devel-1.10.3-10.el6.i686.rpm
     krb5-devel-1.10.3-10.el6.x86_64.rpm
     krb5-libs-1.10.3-10.el6.i686.rpm
     krb5-libs-1.10.3-10.el6.x86_64.rpm
     krb5-pkinit-openssl-1.10.3-10.el6.x86_64.rpm
     krb5-server-1.10.3-10.el6.x86_64.rpm
     krb5-server-ldap-1.10.3-10.el6.i686.rpm
     krb5-server-ldap-1.10.3-10.el6.x86_64.rpm
     krb5-workstation-1.10.3-10.el6.x86_64.rpm
     libdrm-2.4.39-1.el6.i686.rpm
     libdrm-2.4.39-1.el6.x86_64.rpm
     libdrm-devel-2.4.39-1.el6.i686.rpm
     libdrm-devel-2.4.39-1.el6.x86_64.rpm
     libguestfs-1.16.34-2.el6.x86_64.rpm
     libguestfs-devel-1.16.34-2.el6.x86_64.rpm
     libguestfs-java-1.16.34-2.el6.x86_64.rpm
     libguestfs-java-devel-1.16.34-2.el6.x86_64.rpm
     libguestfs-javadoc-1.16.34-2.el6.x86_64.rpm
     libguestfs-tools-1.16.34-2.el6.x86_64.rpm
     libguestfs-tools-c-1.16.34-2.el6.x86_64.rpm
     libguestfs-winsupport-1.0-7.el6.x86_64.rpm
     libldb-1.1.13-3.el6.i686.rpm
     libldb-1.1.13-3.el6.x86_64.rpm
     libldb-devel-1.1.13-3.el6.i686.rpm
     libldb-devel-1.1.13-3.el6.x86_64.rpm
     libsmbclient-3.6.9-151.el6.i686.rpm
     libsmbclient-3.6.9-151.el6.x86_64.rpm
     libsmbclient-devel-3.6.9-151.el6.i686.rpm
     libsmbclient-devel-3.6.9-151.el6.x86_64.rpm
     libtalloc-2.0.7-2.el6.i686.rpm
     libtalloc-2.0.7-2.el6.x86_64.rpm
     libtalloc-devel-2.0.7-2.el6.i686.rpm
     libtalloc-devel-2.0.7-2.el6.x86_64.rpm
     libtdb-1.2.10-1.el6.i686.rpm
     libtdb-1.2.10-1.el6.x86_64.rpm
     libtdb-devel-1.2.10-1.el6.i686.rpm
     libtdb-devel-1.2.10-1.el6.x86_64.rpm
     libtevent-0.9.17-1.el6.i686.rpm
     libtevent-0.9.17-1.el6.x86_64.rpm
     libtevent-devel-0.9.17-1.el6.i686.rpm
     libtevent-devel-0.9.17-1.el6.x86_64.rpm
     ocaml-libguestfs-1.16.34-2.el6.x86_64.rpm
     ocaml-libguestfs-devel-1.16.34-2.el6.x86_64.rpm
     perl-Sys-Guestfs-1.16.34-2.el6.x86_64.rpm
     pyldb-1.1.13-3.el6.x86_64.rpm
     pyldb-devel-1.1.13-3.el6.x86_64.rpm
     pytalloc-2.0.7-2.el6.x86_64.rpm
     pytalloc-devel-2.0.7-2.el6.x86_64.rpm
     python-libguestfs-1.16.34-2.el6.x86_64.rpm
     python-tdb-1.2.10-1.el6.x86_64.rpm
     python-tevent-0.9.17-1.el6.x86_64.rpm
     ruby-libguestfs-1.16.34-2.el6.x86_64.rpm
     samba-3.6.9-151.el6.x86_64.rpm
     samba-client-3.6.9-151.el6.x86_64.rpm
     samba-common-3.6.9-151.el6.i686.rpm
     samba-common-3.6.9-151.el6.x86_64.rpm
     samba-doc-3.6.9-151.el6.x86_64.rpm
     samba-domainjoin-gui-3.6.9-151.el6.x86_64.rpm
     samba-swat-3.6.9-151.el6.x86_64.rpm
     samba-winbind-3.6.9-151.el6.x86_64.rpm
     samba-winbind-clients-3.6.9-151.el6.i686.rpm
     samba-winbind-clients-3.6.9-151.el6.x86_64.rpm
     samba-winbind-devel-3.6.9-151.el6.i686.rpm
     samba-winbind-devel-3.6.9-151.el6.x86_64.rpm
     samba-winbind-krb5-locator-3.6.9-151.el6.x86_64.rpm
     tdb-tools-1.2.10-1.el6.x86_64.rpm

   i386
     krb5-auth-dialog-0.13-3.el6.i686.rpm
     krb5-devel-1.10.3-10.el6.i686.rpm
     krb5-libs-1.10.3-10.el6.i686.rpm
     krb5-pkinit-openssl-1.10.3-10.el6.i686.rpm
     krb5-server-1.10.3-10.el6.i686.rpm
     krb5-server-ldap-1.10.3-10.el6.i686.rpm
     krb5-workstation-1.10.3-10.el6.i686.rpm
     libdrm-2.4.39-1.el6.i686.rpm
     libdrm-devel-2.4.39-1.el6.i686.rpm
     libldb-1.1.13-3.el6.i686.rpm
     libldb-devel-1.1.13-3.el6.i686.rpm
     libsmbclient-3.6.9-151.el6.i686.rpm
     libsmbclient-devel-3.6.9-151.el6.i686.rpm
     libtalloc-2.0.7-2.el6.i686.rpm
     libtalloc-devel-2.0.7-2.el6.i686.rpm
     libtdb-1.2.10-1.el6.i686.rpm
     libtdb-devel-1.2.10-1.el6.i686.rpm
     libtevent-0.9.17-1.el6.i686.rpm
     libtevent-devel-0.9.17-1.el6.i686.rpm
     pyldb-1.1.13-3.el6.i686.rpm
     pyldb-devel-1.1.13-3.el6.i686.rpm
     pytalloc-2.0.7-2.el6.i686.rpm
     pytalloc-devel-2.0.7-2.el6.i686.rpm
     python-tdb-1.2.10-1.el6.i686.rpm
     python-tevent-0.9.17-1.el6.i686.rpm
     samba-3.6.9-151.el6.i686.rpm
     samba-client-3.6.9-151.el6.i686.rpm
     samba-common-3.6.9-151.el6.i686.rpm
     samba-doc-3.6.9-151.el6.i686.rpm
     samba-domainjoin-gui-3.6.9-151.el6.i686.rpm
     samba-swat-3.6.9-151.el6.i686.rpm
     samba-winbind-3.6.9-151.el6.i686.rpm
     samba-winbind-clients-3.6.9-151.el6.i686.rpm
     samba-winbind-devel-3.6.9-151.el6.i686.rpm
     samba-winbind-krb5-locator-3.6.9-151.el6.i686.rpm
     tdb-tools-1.2.10-1.el6.i686.rpm

- Scientific Linux Development Team