Bug 855866 (CVE-2013-6442)

Summary:	VUL-0: CVE-2013-6442: samba: samba4 smbcalcs --chown \| --chgrp dacl regression
Product:	[openSUSE] openSUSE 13.1	Reporter:	Noel Power <nopower>
Component:	Security	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Major
Priority:	P3 - Medium	CC:	ddiss, jmcdonough, lmuelle, meissner, security-team
Version:	Final
Target Milestone:	---
Hardware:	Other
OS:	openSUSE 13.1
Whiteboard:
Found By:	Development	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Noel Power 2013-12-17 13:48:05 UTC

invoking smbcacls with the --chown or --chgrp switches
against a file will delete the ACL list associated with that file.

affects os13.1 only

Comment 1 Marcus Meissner 2013-12-18 10:44:24 UTC

is there a samba bug associated or is this suse specific?

what do you expect from us here  (it seems confused)?

Comment 2 Noel Power 2013-12-18 11:17:18 UTC

(In reply to comment #1)
> is there a samba bug associated or is this suse specific?
> 
no not suse specific,
https://bugzilla.samba.org/show_bug.cgi?id=10327 is the samba issue

Comment 3 Swamp Workflow Management 2013-12-18 23:00:19 UTC

bugbot adjusting priority

Comment 4 Marcus Meissner 2014-03-06 08:40:23 UTC

This bug is also targeted for the March 11 security release.

Comment 6 Marcus Meissner 2014-03-12 10:07:37 UTC

is public now

http://www.samba.org/samba/history/samba-4.1.6.html

CVE-2013-6442:
   Samba versions 4.0.0 and above have a flaw in the smbcacls command. If
   smbcacls is used with the "-C|--chown name" or "-G|--chgrp name"
   command options it will remove the existing ACL on the object being
   modified, leaving the file or directory unprotected.


Issue is samba 4 only, so only openSUSE 13.1 is affected.

Comment 7 Bernhard Wiedemann 2014-03-12 11:01:49 UTC

This is an autogenerated message for OBS integration:
This bug (855866) was mentioned in
https://build.opensuse.org/request/show/225655 13.1 / samba

Comment 9 Bernhard Wiedemann 2014-03-12 15:01:55 UTC

This is an autogenerated message for OBS integration:
This bug (855866) was mentioned in
https://build.opensuse.org/request/show/225706 13.1 / samba

Comment 10 Bernhard Wiedemann 2014-03-12 16:00:40 UTC

This is an autogenerated message for OBS integration:
This bug (855866) was mentioned in
https://build.opensuse.org/request/show/225717 Factory / samba

Comment 11 Marcus Meissner 2014-03-20 06:47:54 UTC

released

Comment 12 Swamp Workflow Management 2014-03-20 07:06:25 UTC

openSUSE-SU-2014:0404-1: An update that solves two vulnerabilities and has 21 fixes is now available.

Category: security (moderate)
Bug References: 437293,726937,786677,844307,846586,849224,855866,856759,857454,860648,860809,860832,861135,862370,862558,863079,863748,865095,865397,865561,865641,865771,867665
CVE References: CVE-2013-4496,CVE-2013-6442
Sources used:
openSUSE 13.1 (src):    samba-4.1.6-3.18.1