1414f1647d
This fixes the following security problems: * CVE-2015-7560 * CVE-2015-5370 * CVE-2016-2110 * CVE-2016-2111 * CVE-2016-2112 * CVE-2016-2115 * CVE-2016-2118 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> SVN-Revision: 49175
88 lines
2.9 KiB
Diff
88 lines
2.9 KiB
Diff
From 25139116756cc285a3a5534834cc276ef1b7baaa Mon Sep 17 00:00:00 2001
|
|
From: Stefan Metzmacher <metze@samba.org>
|
|
Date: Wed, 30 Sep 2015 21:17:02 +0200
|
|
Subject: [PATCH 1/2] CVE-2015-5296: s3:libsmb: force signing when requiring
|
|
encryption in do_connect()
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11536
|
|
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
---
|
|
source3/libsmb/clidfs.c | 7 ++++++-
|
|
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
|
--- a/source3/libsmb/clidfs.c
|
|
+++ b/source3/libsmb/clidfs.c
|
|
@@ -98,6 +98,11 @@ static struct cli_state *do_connect(TALL
|
|
const char *username;
|
|
const char *password;
|
|
NTSTATUS status;
|
|
+ int signing_state = get_cmdline_auth_info_signing_state(auth_info);
|
|
+
|
|
+ if (force_encrypt) {
|
|
+ signing_state = Required;
|
|
+ }
|
|
|
|
/* make a copy so we don't modify the global string 'service' */
|
|
servicename = talloc_strdup(ctx,share);
|
|
@@ -132,7 +137,7 @@ static struct cli_state *do_connect(TALL
|
|
zero_sockaddr(&ss);
|
|
|
|
/* have to open a new connection */
|
|
- c = cli_initialise_ex(get_cmdline_auth_info_signing_state(auth_info));
|
|
+ c = cli_initialise_ex(signing_state);
|
|
if (c == NULL) {
|
|
d_printf("Connection to %s failed\n", server_n);
|
|
return NULL;
|
|
--- a/source3/libsmb/libsmb_server.c
|
|
+++ b/source3/libsmb/libsmb_server.c
|
|
@@ -258,6 +258,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,
|
|
const char *username_used;
|
|
NTSTATUS status;
|
|
char *newserver, *newshare;
|
|
+ int signing_state = Undefined;
|
|
|
|
zero_sockaddr(&ss);
|
|
ZERO_STRUCT(c);
|
|
@@ -404,8 +405,12 @@ again:
|
|
|
|
zero_sockaddr(&ss);
|
|
|
|
+ if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
|
|
+ signing_state = Required;
|
|
+ }
|
|
+
|
|
/* have to open a new connection */
|
|
- if ((c = cli_initialise()) == NULL) {
|
|
+ if ((c = cli_initialise_ex(signing_state)) == NULL) {
|
|
errno = ENOMEM;
|
|
return NULL;
|
|
}
|
|
@@ -750,6 +755,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,
|
|
ipc_srv = SMBC_find_server(ctx, context, server, "*IPC$",
|
|
pp_workgroup, pp_username, pp_password);
|
|
if (!ipc_srv) {
|
|
+ int signing_state = Undefined;
|
|
|
|
/* We didn't find a cached connection. Get the password */
|
|
if (!*pp_password || (*pp_password)[0] == '\0') {
|
|
@@ -771,6 +777,9 @@ SMBC_attr_server(TALLOC_CTX *ctx,
|
|
if (smbc_getOptionUseCCache(context)) {
|
|
flags |= CLI_FULL_CONNECTION_USE_CCACHE;
|
|
}
|
|
+ if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
|
|
+ signing_state = Required;
|
|
+ }
|
|
|
|
zero_sockaddr(&ss);
|
|
nt_status = cli_full_connection(&ipc_cli,
|
|
@@ -780,7 +789,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,
|
|
*pp_workgroup,
|
|
*pp_password,
|
|
flags,
|
|
- Undefined);
|
|
+ signing_state);
|
|
if (! NT_STATUS_IS_OK(nt_status)) {
|
|
DEBUG(1,("cli_full_connection failed! (%s)\n",
|
|
nt_errstr(nt_status)));
|