Bug 855866 (CVE-2013-6442)

Summary: VUL-0: CVE-2013-6442: samba: samba4 smbcalcs --chown | --chgrp dacl regression
Product: [openSUSE] openSUSE 13.1 Reporter: Noel Power <nopower>
Component: SecurityAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Major    
Priority: P3 - Medium CC: ddiss, jmcdonough, lmuelle, meissner, security-team
Version: Final   
Target Milestone: ---   
Hardware: Other   
OS: openSUSE 13.1   
Whiteboard:
Found By: Development Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Noel Power 2013-12-17 13:48:05 UTC
invoking smbcacls with the --chown or --chgrp switches
against a file will delete the ACL list associated with that file.

affects os13.1 only
Comment 1 Marcus Meissner 2013-12-18 10:44:24 UTC
is there a samba bug associated or is this suse specific?

what do you expect from us here  (it seems confused)?
Comment 2 Noel Power 2013-12-18 11:17:18 UTC
(In reply to comment #1)
> is there a samba bug associated or is this suse specific?
> 
no not suse specific,
https://bugzilla.samba.org/show_bug.cgi?id=10327 is the samba issue
Comment 3 Swamp Workflow Management 2013-12-18 23:00:19 UTC
bugbot adjusting priority
Comment 4 Marcus Meissner 2014-03-06 08:40:23 UTC
This bug is also targeted for the March 11 security release.
Comment 6 Marcus Meissner 2014-03-12 10:07:37 UTC
is public now

http://www.samba.org/samba/history/samba-4.1.6.html

CVE-2013-6442:
   Samba versions 4.0.0 and above have a flaw in the smbcacls command. If
   smbcacls is used with the "-C|--chown name" or "-G|--chgrp name"
   command options it will remove the existing ACL on the object being
   modified, leaving the file or directory unprotected.


Issue is samba 4 only, so only openSUSE 13.1 is affected.
Comment 7 Bernhard Wiedemann 2014-03-12 11:01:49 UTC
This is an autogenerated message for OBS integration:
This bug (855866) was mentioned in
https://build.opensuse.org/request/show/225655 13.1 / samba
Comment 9 Bernhard Wiedemann 2014-03-12 15:01:55 UTC
This is an autogenerated message for OBS integration:
This bug (855866) was mentioned in
https://build.opensuse.org/request/show/225706 13.1 / samba
Comment 10 Bernhard Wiedemann 2014-03-12 16:00:40 UTC
This is an autogenerated message for OBS integration:
This bug (855866) was mentioned in
https://build.opensuse.org/request/show/225717 Factory / samba
Comment 11 Marcus Meissner 2014-03-20 06:47:54 UTC
released
Comment 12 Swamp Workflow Management 2014-03-20 07:06:25 UTC
openSUSE-SU-2014:0404-1: An update that solves two vulnerabilities and has 21 fixes is now available.

Category: security (moderate)
Bug References: 437293,726937,786677,844307,846586,849224,855866,856759,857454,860648,860809,860832,861135,862370,862558,863079,863748,865095,865397,865561,865641,865771,867665
CVE References: CVE-2013-4496,CVE-2013-6442
Sources used:
openSUSE 13.1 (src):    samba-4.1.6-3.18.1