One solution is to upgrade to the latest version of Samba, but if you cannot do that then these changes to your smb.conf will also work:
Previous variant:
[webroot]
  comment = webroot
  path = /webroot
  public = yes
  writable = yes
  guest ok = yes
  browsable = yes

New variant:
[webroot]
  comment = webroot
  path = /webroot
  public = yes
  writable = yes
  guest ok = yes
  browsable = yes
  create mask = 0644
  force create mode = 0600
  security mask = 0555
  force security mode = 0600