1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml">
6 <title>Samba - Release Notes Archive</title>
11 <H2>Samba 3.6.23 Available for Download</H2>
15 ==============================
16 Release Notes for Samba 3.6.23
18 ==============================
21 This is a security release in order to address
22 CVE-2013-4496 (Password lockout not enforced for SAMR password changes).
25 Samba versions 3.4.0 and above allow the administrator to implement
26 locking out Samba accounts after a number of bad password attempts.
28 However, all released versions of Samba did not implement this check for
29 password changes, such as are available over multiple SAMR and RAP
30 interfaces, allowing password guessing attacks.
36 o Andrew Bartlett <abartlet@samba.org>
37 * BUG 10245: CVE-2013-4496: Enforce password lockout for SAMR password
41 o Stefan Metzmacher <metze@samba.org>
42 * BUG 10245: CVE-2013-4496: Enforce password lockout for SAMR password