samba36: fix some security problems
This Adds fixes for the following security problems based on debians patches: CVE-2016-2125: Unconditional privilege delegation to Kerberos servers in trusted realms CVE-2017-12163: Server memory information leak over SMB1 CVE-2017-12150: SMB1/2/3 connections may not require signing where they should CVE-2018-1050: Denial of Service Attack on external print server. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
parent
d6d3db0543
commit
9aaa23ec8b
8 changed files with 322 additions and 3 deletions
|
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
|
|||
|
||||
PKG_NAME:=samba
|
||||
PKG_VERSION:=3.6.25
|
||||
PKG_RELEASE:=9
|
||||
PKG_RELEASE:=10
|
||||
|
||||
PKG_SOURCE_URL:=https://download.samba.org/pub/samba \
|
||||
https://download.samba.org/pub/samba/stable
|
||||
|
|
|
@ -0,0 +1,59 @@
|
|||
From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>
|
||||
Date: Wed, 28 Dec 2016 19:21:49 +0100
|
||||
Subject: security-CVE-2016-2125: Don't pass GSS_C_DELEG_FLAG by default
|
||||
|
||||
This is a backport of upstream commits
|
||||
|
||||
b1a056f77e793efc45df34ab7bf78fbec1bf8a59
|
||||
b83897ae49fdee1fda73c10c7fe73362bfaba690 (code not used in wheezy)
|
||||
3106964a640ddf6a3c08c634ff586a814f94dff8 (code not used in wheezy)
|
||||
---
|
||||
source3/librpc/crypto/gse.c | 1 -
|
||||
source3/libsmb/clifsinfo.c | 2 +-
|
||||
source4/auth/gensec/gensec_gssapi.c | 2 +-
|
||||
source4/scripting/bin/nsupdate-gss | 2 +-
|
||||
4 files changed, 3 insertions(+), 4 deletions(-)
|
||||
|
||||
--- a/source3/librpc/crypto/gse.c
|
||||
+++ b/source3/librpc/crypto/gse.c
|
||||
@@ -162,7 +162,6 @@ static NTSTATUS gse_context_init(TALLOC_
|
||||
memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
|
||||
|
||||
gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
|
||||
- GSS_C_DELEG_FLAG |
|
||||
GSS_C_DELEG_POLICY_FLAG |
|
||||
GSS_C_REPLAY_FLAG |
|
||||
GSS_C_SEQUENCE_FLAG;
|
||||
--- a/source3/libsmb/clifsinfo.c
|
||||
+++ b/source3/libsmb/clifsinfo.c
|
||||
@@ -726,7 +726,7 @@ static NTSTATUS make_cli_gss_blob(TALLOC
|
||||
&es->s.gss_state->gss_ctx,
|
||||
srv_name,
|
||||
GSS_C_NO_OID, /* default OID. */
|
||||
- GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_FLAG,
|
||||
+ GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_POLICY_FLAG,
|
||||
GSS_C_INDEFINITE, /* requested ticket lifetime. */
|
||||
NULL, /* no channel bindings */
|
||||
p_tok_in,
|
||||
--- a/source4/auth/gensec/gensec_gssapi.c
|
||||
+++ b/source4/auth/gensec/gensec_gssapi.c
|
||||
@@ -172,7 +172,7 @@ static NTSTATUS gensec_gssapi_start(stru
|
||||
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) {
|
||||
gensec_gssapi_state->want_flags |= GSS_C_MUTUAL_FLAG;
|
||||
}
|
||||
- if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) {
|
||||
+ if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", false)) {
|
||||
gensec_gssapi_state->want_flags |= GSS_C_DELEG_FLAG;
|
||||
}
|
||||
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) {
|
||||
--- a/source4/scripting/bin/nsupdate-gss
|
||||
+++ b/source4/scripting/bin/nsupdate-gss
|
||||
@@ -178,7 +178,7 @@ sub negotiate_tkey($$$$)
|
||||
my $flags =
|
||||
GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG |
|
||||
GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG |
|
||||
- GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG;
|
||||
+ GSS_C_INTEG_FLAG;
|
||||
|
||||
|
||||
$status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE,
|
|
@ -0,0 +1,136 @@
|
|||
From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>
|
||||
Date: Wed, 20 Sep 2017 20:02:03 +0200
|
||||
Subject: CVE-2017-12163: s3:smbd: Prevent client short SMB1 write from
|
||||
writing server memory to file.
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13020
|
||||
|
||||
Author: Jeremy Allison <jra@samba.org>
|
||||
Signed-off-by: Jeremy Allison <jra@samba.org>
|
||||
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
||||
---
|
||||
source3/smbd/reply.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
|
||||
1 file changed, 50 insertions(+)
|
||||
|
||||
--- a/source3/smbd/reply.c
|
||||
+++ b/source3/smbd/reply.c
|
||||
@@ -3979,6 +3979,9 @@ void reply_writebraw(struct smb_request
|
||||
}
|
||||
|
||||
/* Ensure we don't write bytes past the end of this packet. */
|
||||
+ /*
|
||||
+ * This already protects us against CVE-2017-12163.
|
||||
+ */
|
||||
if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
|
||||
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||
error_to_writebrawerr(req);
|
||||
@@ -4080,6 +4083,11 @@ void reply_writebraw(struct smb_request
|
||||
exit_server_cleanly("secondary writebraw failed");
|
||||
}
|
||||
|
||||
+ /*
|
||||
+ * We are not vulnerable to CVE-2017-12163
|
||||
+ * here as we are guarenteed to have numtowrite
|
||||
+ * bytes available - we just read from the client.
|
||||
+ */
|
||||
nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
|
||||
if (nwritten == -1) {
|
||||
TALLOC_FREE(buf);
|
||||
@@ -4161,6 +4169,7 @@ void reply_writeunlock(struct smb_reques
|
||||
connection_struct *conn = req->conn;
|
||||
ssize_t nwritten = -1;
|
||||
size_t numtowrite;
|
||||
+ size_t remaining;
|
||||
SMB_OFF_T startpos;
|
||||
const char *data;
|
||||
NTSTATUS status = NT_STATUS_OK;
|
||||
@@ -4193,6 +4202,17 @@ void reply_writeunlock(struct smb_reques
|
||||
startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
|
||||
data = (const char *)req->buf + 3;
|
||||
|
||||
+ /*
|
||||
+ * Ensure client isn't asking us to write more than
|
||||
+ * they sent. CVE-2017-12163.
|
||||
+ */
|
||||
+ remaining = smbreq_bufrem(req, data);
|
||||
+ if (numtowrite > remaining) {
|
||||
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||
+ END_PROFILE(SMBwriteunlock);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
if (!fsp->print_file && numtowrite > 0) {
|
||||
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
|
||||
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
|
||||
@@ -4274,6 +4294,7 @@ void reply_write(struct smb_request *req
|
||||
{
|
||||
connection_struct *conn = req->conn;
|
||||
size_t numtowrite;
|
||||
+ size_t remaining;
|
||||
ssize_t nwritten = -1;
|
||||
SMB_OFF_T startpos;
|
||||
const char *data;
|
||||
@@ -4314,6 +4335,17 @@ void reply_write(struct smb_request *req
|
||||
startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
|
||||
data = (const char *)req->buf + 3;
|
||||
|
||||
+ /*
|
||||
+ * Ensure client isn't asking us to write more than
|
||||
+ * they sent. CVE-2017-12163.
|
||||
+ */
|
||||
+ remaining = smbreq_bufrem(req, data);
|
||||
+ if (numtowrite > remaining) {
|
||||
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||
+ END_PROFILE(SMBwrite);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
if (!fsp->print_file) {
|
||||
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
|
||||
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
|
||||
@@ -4525,6 +4557,9 @@ void reply_write_and_X(struct smb_reques
|
||||
return;
|
||||
}
|
||||
} else {
|
||||
+ /*
|
||||
+ * This already protects us against CVE-2017-12163.
|
||||
+ */
|
||||
if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
|
||||
smb_doff + numtowrite > smblen) {
|
||||
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||
@@ -4894,6 +4929,7 @@ void reply_writeclose(struct smb_request
|
||||
{
|
||||
connection_struct *conn = req->conn;
|
||||
size_t numtowrite;
|
||||
+ size_t remaining;
|
||||
ssize_t nwritten = -1;
|
||||
NTSTATUS close_status = NT_STATUS_OK;
|
||||
SMB_OFF_T startpos;
|
||||
@@ -4927,6 +4963,17 @@ void reply_writeclose(struct smb_request
|
||||
mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
|
||||
data = (const char *)req->buf + 1;
|
||||
|
||||
+ /*
|
||||
+ * Ensure client isn't asking us to write more than
|
||||
+ * they sent. CVE-2017-12163.
|
||||
+ */
|
||||
+ remaining = smbreq_bufrem(req, data);
|
||||
+ if (numtowrite > remaining) {
|
||||
+ reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||
+ END_PROFILE(SMBwriteclose);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
if (!fsp->print_file) {
|
||||
init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
|
||||
(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
|
||||
@@ -5497,6 +5544,9 @@ void reply_printwrite(struct smb_request
|
||||
|
||||
numtowrite = SVAL(req->buf, 1);
|
||||
|
||||
+ /*
|
||||
+ * This already protects us against CVE-2017-12163.
|
||||
+ */
|
||||
if (req->buflen < numtowrite + 3) {
|
||||
reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
||||
END_PROFILE(SMBsplwr);
|
|
@ -0,0 +1,75 @@
|
|||
From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>
|
||||
Date: Wed, 20 Sep 2017 20:01:34 +0200
|
||||
Subject: CVE-2017-12150
|
||||
|
||||
These are the three upstream patches
|
||||
|
||||
From: Stefan Metzmacher <metze@samba.org>
|
||||
Subject: CVE-2017-12150: s3:lib: get_cmdline_auth_info_signing_state use Required for smb_encrypt
|
||||
|
||||
This is an addition to the fixes for CVE-2015-5296.
|
||||
|
||||
It applies to smb2mount -e, smbcacls -e and smbcquotas -e.
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
|
||||
|
||||
|
||||
From: Stefan Metzmacher <metze@samba.org>
|
||||
Subject: CVE-2017-12150: libgpo: make use of Required for SMB signing in gpo_connect_server()
|
||||
|
||||
It's important that we use a signed connection to get the GPOs!
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
|
||||
|
||||
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
||||
Backported-by: Andreas Schneider <asn@samba.org>
|
||||
|
||||
|
||||
From: Stefan Metzmacher <metze@samba.org>
|
||||
Subject: CVE-2017-12150: s3:libsmb: only fallback to anonymous if authentication was not requested
|
||||
|
||||
With forced encryption or required signing we should also don't fallback.
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12997
|
||||
|
||||
---
|
||||
libgpo/gpo_fetch.c | 2 +-
|
||||
source3/lib/util_cmdline.c | 3 +++
|
||||
source3/libsmb/clidfs.c | 2 ++
|
||||
3 files changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/libgpo/gpo_fetch.c
|
||||
+++ b/libgpo/gpo_fetch.c
|
||||
@@ -151,7 +151,7 @@ static NTSTATUS gpo_connect_server(ADS_S
|
||||
ads->auth.password,
|
||||
CLI_FULL_CONNECTION_USE_KERBEROS |
|
||||
CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS,
|
||||
- Undefined);
|
||||
+ Required);
|
||||
if (!NT_STATUS_IS_OK(result)) {
|
||||
DEBUG(10,("check_refresh_gpo: "
|
||||
"failed to connect: %s\n",
|
||||
--- a/source3/lib/util_cmdline.c
|
||||
+++ b/source3/lib/util_cmdline.c
|
||||
@@ -122,6 +122,9 @@ bool set_cmdline_auth_info_signing_state
|
||||
|
||||
int get_cmdline_auth_info_signing_state(const struct user_auth_info *auth_info)
|
||||
{
|
||||
+ if (auth_info->smb_encrypt) {
|
||||
+ return Required;
|
||||
+ }
|
||||
return auth_info->signing_state;
|
||||
}
|
||||
|
||||
--- a/source3/libsmb/clidfs.c
|
||||
+++ b/source3/libsmb/clidfs.c
|
||||
@@ -202,7 +202,9 @@ static struct cli_state *do_connect(TALL
|
||||
/* If a password was not supplied then
|
||||
* try again with a null username. */
|
||||
if (password[0] || !username[0] ||
|
||||
+ force_encrypt || client_is_signing_mandatory(c) ||
|
||||
get_cmdline_auth_info_use_kerberos(auth_info) ||
|
||||
+ get_cmdline_auth_info_use_ccache(auth_info) ||
|
||||
!NT_STATUS_IS_OK(cli_session_setup(c, "",
|
||||
"", 0,
|
||||
"", 0,
|
|
@ -0,0 +1,49 @@
|
|||
From 6cc45e3452194f312e04109cfdae047eb0719c7c Mon Sep 17 00:00:00 2001
|
||||
From: Jeremy Allison <jra@samba.org>
|
||||
Date: Tue, 2 Jan 2018 15:56:03 -0800
|
||||
Subject: [PATCH] CVE-2018-1050: s3: RPC: spoolss server. Protect against null
|
||||
pointer derefs.
|
||||
|
||||
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11343
|
||||
|
||||
Signed-off-by: Jeremy Allison <jra@samba.org>
|
||||
---
|
||||
source3/rpc_server/spoolss/srv_spoolss_nt.c | 13 +++++++++++++
|
||||
1 file changed, 13 insertions(+)
|
||||
|
||||
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
||||
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
|
||||
@@ -176,6 +176,11 @@ static void prune_printername_cache(void
|
||||
static const char *canon_servername(const char *servername)
|
||||
{
|
||||
const char *pservername = servername;
|
||||
+
|
||||
+ if (servername == NULL) {
|
||||
+ return "";
|
||||
+ }
|
||||
+
|
||||
while (*pservername == '\\') {
|
||||
pservername++;
|
||||
}
|
||||
@@ -2080,6 +2085,10 @@ WERROR _spoolss_DeletePrinterDriver(stru
|
||||
return WERR_ACCESS_DENIED;
|
||||
}
|
||||
|
||||
+ if (r->in.architecture == NULL || r->in.driver == NULL) {
|
||||
+ return WERR_INVALID_ENVIRONMENT;
|
||||
+ }
|
||||
+
|
||||
/* check that we have a valid driver name first */
|
||||
|
||||
if ((version = get_version_id(r->in.architecture)) == -1)
|
||||
@@ -2225,6 +2234,10 @@ WERROR _spoolss_DeletePrinterDriverEx(st
|
||||
return WERR_ACCESS_DENIED;
|
||||
}
|
||||
|
||||
+ if (r->in.architecture == NULL || r->in.driver == NULL) {
|
||||
+ return WERR_INVALID_ENVIRONMENT;
|
||||
+ }
|
||||
+
|
||||
/* check that we have a valid driver name first */
|
||||
if (get_version_id(r->in.architecture) == -1) {
|
||||
/* this is what NT returns */
|
|
@ -51,7 +51,7 @@
|
|||
d_printf(_("Usage:\n"));
|
||||
--- a/source3/smbd/reply.c
|
||||
+++ b/source3/smbd/reply.c
|
||||
@@ -5208,7 +5208,11 @@ void reply_printopen(struct smb_request
|
||||
@@ -5255,7 +5255,11 @@ void reply_printopen(struct smb_request
|
||||
return;
|
||||
}
|
||||
|
||||
|
@ -64,7 +64,7 @@
|
|||
reply_nterror(req, NT_STATUS_ACCESS_DENIED);
|
||||
END_PROFILE(SMBsplopen);
|
||||
return;
|
||||
@@ -5314,7 +5318,10 @@ void reply_printqueue(struct smb_request
|
||||
@@ -5361,7 +5365,10 @@ void reply_printqueue(struct smb_request
|
||||
is really quite gross and only worked when there was only
|
||||
one printer - I think we should now only accept it if they
|
||||
get it right (tridge) */
|
||||
|
|
Loading…
Reference in a new issue