CVE-2019-10197 restricted share escape by user
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
samba |
Unknown
|
Unknown
|
|||
samba (Ubuntu) |
Fix Released
|
Undecided
|
Bryce Harrington |
Bug Description
samba (2:4.10.
* SECURITY UPDATE: restricted share escape by user
- debian/
out impersonation debug info into a new function.
- debian/
change_
- debian/
reset current_
- debian/
fsrvp_share its own independent subdirectory
- debian/
test_
on share root problem
- debian/
change_
- CVE-2019-10197
-- Steve Beattie <email address hidden> Fri, 30 Aug 2019 11:07:19 -0700
A PPA build with this patch is available from the security team at:
https:/
I've also uploaded it to my own PPA here, to doublecheck the build:
https:/
CVE References
information type: | Public → Private Security |
Changed in samba (Ubuntu): | |
status: | New → In Progress |
assignee: | nobody → Bryce Harrington (bryce) |
summary: |
- CVE-2019-10197 + CVE-2019-10197 restricted share escape by user |
description: | updated |
information type: | Private Security → Public Security |
Building this locally with `git ubuntu build` failed with an error about symbols discrepancy:
dpkg-gensymbols: error: some new symbols appeared in the symbols file: see diff output below libsmbclient/ DEBIAN/ symbols doesn't match completely debian/ libsmbclient. symbols dh_makeshlibs] Error 255 buildpackage: error: fakeroot debian/rules binary subprocess returned exit status 2
dpkg-gensymbols: error: some symbols or patterns disappeared in the symbols file: see diff output below
dpkg-gensymbols: warning: debian/
dh_makeshlibs: failing due to earlier errors
make[1]: *** [debian/rules:255: override_
make: *** [debian/rules:87: binary] Error 2
dpkg-
09/03/2019 18:41:28 - ERROR:Failed to build
However, the patchset does not remove any symbols, and the only function it adds is a static internal routine for printing some information. So I think this is a spurious error, but am doing a build in a PPA just to doublecheck.
Apart from that, the upload looks good to go:
√ Codereviewed patches
√ Verified patches match what was proposed upstream
√ Verified changelog text and format
√ Verified patches listed correctly in d/p/series
I don't have authorization to the upstream bug report, so was unable to verify that, but the change makes sense for fixing the issue it alludes to.