============================= Release Notes for Samba 3.3.8 October, 1 2009 ============================= This is a security release in order to address CVE-2009-2813, CVE-2009-2948 and CVE-2009-2906. o CVE-2009-2813: In all versions of Samba later than 3.0.11, connecting to the home share of a user will use the root of the filesystem as the home directory if this user is misconfigured to have an empty home directory in /etc/passwd. o CVE-2009-2948: If mount.cifs is installed as a setuid program, a user can pass it a credential or password path to which he or she does not have access and then use the --verbose option to view the first line of that file. All known Samba versions are affected. o CVE-2009-2906: Specially crafted SMB requests on authenticated SMB connections can send smbd into a 100% CPU loop, causing a DoS on the Samba server. ###################################################################### Changes ####### Changes since 3.3.7 ------------------- o Jeremy Allison <jra@samba.org> * BUG 6763: Fix for CVE-2009-2813. * BUG 6768: Fix for CVE-2009-2906. o Jeff Layton <jlayton@redhat.com> * Fix for CVE-2009-2948.