The branch, v3-3-stable has been updated via 5f1f1c47623f846909481073d56bc909d13e5e37 (commit) via 7fbee9050d08335c6a3dbf6e267c823b33e928c4 (commit) via 8afa10ad7d7e81bcae27b6a913210ef8a1ee4426 (commit) via ec0ee6753818d546ad5817bdb09cdd3b7c5673af (commit) via 8f0af2ed4f330be558987dd52c32b32e4b8ed95f (commit) via f9d71be5013dd8903d39645b6a03332ae18646ed (commit) via c353ad6d63dc884566cc11df12d9461577031634 (commit) from 55abe9f10abc97ad16e6c0c2fcf5303f5a700abd (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-3-stable - Log ----------------------------------------------------------------- commit 5f1f1c47623f846909481073d56bc909d13e5e37 Author: Jeremy Allison <j...@samba.org> Date: Wed Sep 30 14:27:26 2009 +0200 Fix for CVE-2009-2906. Summary: Specially crafted SMB requests on authenticated SMB connections can send smbd into a 100% CPU loop, causing a DoS on the Samba server. commit 7fbee9050d08335c6a3dbf6e267c823b33e928c4 Author: Karolin Seeger <ksee...@samba.org> Date: Wed Sep 30 13:55:06 2009 +0200 WHATSNEW: Update release notes. Karolin commit 8afa10ad7d7e81bcae27b6a913210ef8a1ee4426 Author: Jeremy Allison <j...@samba.org> Date: Mon Sep 28 13:44:12 2009 +0200 Fix for CVE-2009-2813. =========================================================== == Subject: Misconfigured /etc/passwd file may share folders unexpectedly == == CVE ID#: CVE-2009-2813 == == Versions: All versions of Samba later than 3.0.11 == == Summary: If a user in /etc/passwd is misconfigured to have == an empty home directory then connecting to the home == share of this user will use the root of the filesystem == as the home directory. =========================================================== commit ec0ee6753818d546ad5817bdb09cdd3b7c5673af Author: Jeff Layton <jlay...@redhat.com> Date: Fri Sep 25 07:01:59 2009 -0400 mount.cifs: don't leak passwords with verbose option When running mount.cifs with the --verbose option, it'll print out the option string that it passes to the kernel...including the mount password if there is one. Print a placeholder string instead to help ensure that this info can't be used for nefarious purposes. Also, the --verbose option printed the option string before it was completely assembled anyway. This patch should also make sure that the complete option string is printed out. Finally, strndup passwords passed in on the command line to ensure that they aren't shown by --verbose as well. Passwords used this way can never be truly kept private from other users on the machine of course, but it's simple enough to do it this way for completeness sake. Reported-by: Ronald Volgers <r.c.volg...@student.utwente.nl> Signed-off-by: Jeff Layton <jlay...@redhat.com> Acked-by: Steve French <sfre...@us.ibm.com> Part 2/2 of a fix for CVE-2009-2948. commit 8f0af2ed4f330be558987dd52c32b32e4b8ed95f Author: Jeff Layton <jlay...@redhat.com> Date: Fri Sep 25 07:00:18 2009 -0400 mount.cifs: check access of credential files before opening It's possible for an unprivileged user to pass a setuid mount.cifs a credential or password file to which he does not have access. This can cause mount.cifs to open the file on his behalf and possibly leak the info in the first few lines of the file. Check the access permissions of the file before opening it. Reported-by: Ronald Volgers <r.c.volg...@student.utwente.nl> Signed-off-by: Jeff Layton <jlay...@redhat.com> Acked-by: Steve French <sfre...@us.ibm.com> Part 1/2 of a fix for CVE-2009-2948. commit f9d71be5013dd8903d39645b6a03332ae18646ed Author: Karolin Seeger <ksee...@samba.org> Date: Mon Sep 28 13:39:23 2009 +0200 WHATSNEW: Prepare release notes for 3.3.8. Karolin commit c353ad6d63dc884566cc11df12d9461577031634 Author: Karolin Seeger <ksee...@samba.org> Date: Thu Sep 24 14:28:54 2009 +0200 Raise version up to 3.3.8. Karolin ----------------------------------------------------------------------- Summary of changes: WHATSNEW.txt | 70 ++++++++++++++++++++++++++++++++++++++++++- source/VERSION | 2 +- source/client/mount.cifs.c | 65 ++++++++++++++++++++++++++++------------ source/include/smb.h | 1 + source/param/loadparm.c | 7 ++++- source/smbd/process.c | 28 +++++++++++++++-- source/smbd/service.c | 6 +++- 7 files changed, 151 insertions(+), 28 deletions(-) Changeset truncated at 500 lines: diff --git a/WHATSNEW.txt b/WHATSNEW.txt index faf8f75..0d9aaac 100644 --- a/WHATSNEW.txt +++ b/WHATSNEW.txt @@ -1,4 +1,70 @@ ============================= + Release Notes for Samba 3.3.8 + October, 1 2009 + ============================= + + +This is a security release in order to address CVE-2009-2813, CVE-2009-2948 +and CVE-2009-2906. + + o CVE-2009-2813: + In all versions of Samba later than 3.0.11, connecting to the home + share of a user will use the root of the filesystem + as the home directory if this user is misconfigured to have + an empty home directory in /etc/passwd. + + o CVE-2009-2948: + If mount.cifs is installed as a setuid program, a user can pass it a + credential or password path to which he or she does not have access and + then use the --verbose option to view the first line of that file. + All known Samba versions are affected. + + o CVE-2009-2906: + Specially crafted SMB requests on authenticated SMB connections can + send smbd into a 100% CPU loop, causing a DoS on the Samba server. + + +###################################################################### +Changes +####### + +Changes since 3.3.7 +------------------- + + +o Jeremy Allison <j...@samba.org> + * BUG 6763: Fix for CVE-2009-2813. + * BUG 6768: Fix for CVE-2009-2906. + + +o Jeff Layton <jlay...@redhat.com> + * Fix for CVE-2009-2948. + + +###################################################################### +Reporting bugs & Development Discussion +####################################### + +Please discuss this release on the samba-technical mailing list or by +joining the #samba-technical IRC channel on irc.freenode.net. + +If you do report problems then please try to send high quality +feedback. If you don't provide vital information to help us track down +the problem then you will probably be ignored. All bug reports should +be filed under the Samba 3.3 product in the project's Bugzilla +database (https://bugzilla.samba.org/). + + +====================================================================== +== Our Code, Our Bugs, Our Responsibility. +== The Samba Team +====================================================================== + + +Release notes for older releases follow: +---------------------------------------- + + ============================= Release Notes for Samba 3.3.7 July, 29 2009 ============================= @@ -72,8 +138,8 @@ database (https://bugzilla.samba.org/). ====================================================================== -Release notes for older releases follow: ----------------------------------------- +---------------------------------------------------------------------- + ============================= Release Notes for Samba 3.3.6 diff --git a/source/VERSION b/source/VERSION index ae78b74..7aff985 100644 --- a/source/VERSION +++ b/source/VERSION @@ -25,7 +25,7 @@ ######################################################## SAMBA_VERSION_MAJOR=3 SAMBA_VERSION_MINOR=3 -SAMBA_VERSION_RELEASE=7 +SAMBA_VERSION_RELEASE=8 ######################################################## # Bug fix releases use a letter for the patch revision # diff --git a/source/client/mount.cifs.c b/source/client/mount.cifs.c index 8b62ef7..c78aee0 100644 --- a/source/client/mount.cifs.c +++ b/source/client/mount.cifs.c @@ -199,6 +199,11 @@ static int open_cred_file(char * file_name) char * temp_val; FILE * fs; int i, length; + + i = access(file_name, R_OK); + if (i) + return i; + fs = fopen(file_name,"r"); if(fs == NULL) return errno; @@ -321,6 +326,12 @@ static int get_password_from_file(int file_descript, char * filename) } if(filename != NULL) { + rc = access(filename, R_OK); + if (rc) { + fprintf(stderr, "mount.cifs failed: access check of %s failed: %s\n", + filename, strerror(errno)); + exit(EX_SYSERR); + } file_descript = open(filename, O_RDONLY); if(file_descript < 0) { printf("mount.cifs failed. %s attempting to open password file %s\n", @@ -380,9 +391,6 @@ static int parse_options(char ** optionsp, int * filesys_flags) return 1; data = *optionsp; - if(verboseflag) - printf("parsing options: %s\n", data); - /* BB fixme check for separator override BB */ if (getuid()) { @@ -471,18 +479,27 @@ static int parse_options(char ** optionsp, int * filesys_flags) } else if (strncmp(data, "pass", 4) == 0) { if (!value || !*value) { if(got_password) { - printf("\npassword specified twice, ignoring second\n"); + fprintf(stderr, "\npassword specified twice, ignoring second\n"); } else got_password = 1; - } else if (strnlen(value, 17) < 17) { - if(got_password) - printf("\nmount.cifs warning - password specified twice\n"); - got_password = 1; + } else if (strnlen(value, MOUNT_PASSWD_SIZE) < MOUNT_PASSWD_SIZE) { + if (got_password) { + fprintf(stderr, "\nmount.cifs warning - password specified twice\n"); + } else { + mountpassword = strndup(value, MOUNT_PASSWD_SIZE); + if (!mountpassword) { + fprintf(stderr, "mount.cifs error: %s", strerror(ENOMEM)); + SAFE_FREE(out); + return 1; + } + got_password = 1; + } } else { - printf("password too long\n"); + fprintf(stderr, "password too long\n"); SAFE_FREE(out); return 1; } + goto nocopy; } else if (strncmp(data, "sec", 3) == 0) { if (value) { if (!strncmp(value, "none", 4) || @@ -1370,15 +1387,6 @@ mount_retry: strlcat(options,domain_name,options_size); } } - if(mountpassword) { - /* Commas have to be doubled, or else they will - look like the parameter separator */ -/* if(sep is not set)*/ - if(retry == 0) - check_for_comma(&mountpassword); - strlcat(options,",pass=",options_size); - strlcat(options,mountpassword,options_size); - } strlcat(options,",ver=",options_size); strlcat(options,MOUNT_CIFS_VERSION_MAJOR,options_size); @@ -1391,8 +1399,6 @@ mount_retry: strlcat(options,",prefixpath=",options_size); strlcat(options,prefixpath,options_size); /* no need to cat the / */ } - if(verboseflag) - printf("\nmount.cifs kernel mount options %s \n",options); /* convert all '\\' to '/' in share portion so that /proc/mounts looks pretty */ replace_char(dev_name, '\\', '/', strlen(share_name)); @@ -1424,6 +1430,25 @@ mount_retry: } } + if(verboseflag) + fprintf(stderr, "\nmount.cifs kernel mount options: %s", options); + + if (mountpassword) { + /* + * Commas have to be doubled, or else they will + * look like the parameter separator + */ + if(retry == 0) + check_for_comma(&mountpassword); + strlcat(options,",pass=",options_size); + strlcat(options,mountpassword,options_size); + if (verboseflag) + fprintf(stderr, ",pass=********"); + } + + if (verboseflag) + fprintf(stderr, "\n"); + if (!fakemnt && mount(dev_name, mountpoint, "cifs", flags, options)) { switch (errno) { case ECONNREFUSED: diff --git a/source/include/smb.h b/source/include/smb.h index 56d9461..327f212 100644 --- a/source/include/smb.h +++ b/source/include/smb.h @@ -715,6 +715,7 @@ struct pending_message_list { struct timeval request_time; /* When was this first issued? */ struct timeval end_time; /* When does this time out? */ bool encrypted; + bool processed; DATA_BLOB buf; DATA_BLOB private_data; }; diff --git a/source/param/loadparm.c b/source/param/loadparm.c index 3908aef..491264e 100644 --- a/source/param/loadparm.c +++ b/source/param/loadparm.c @@ -5875,6 +5875,11 @@ bool lp_add_home(const char *pszHomename, int iDefaultService, { int i; + if (pszHomename == NULL || user == NULL || pszHomedir == NULL || + pszHomedir[0] == '\0') { + return false; + } + i = add_a_service(ServicePtrs[iDefaultService], pszHomename); if (i < 0) @@ -7848,7 +7853,7 @@ static void lp_add_auto_services(char *str) home = get_user_home_dir(talloc_tos(), p); - if (home && homes >= 0) + if (home && home[0] && homes >= 0) lp_add_home(p, homes, p, home); TALLOC_FREE(home); diff --git a/source/smbd/process.c b/source/smbd/process.c index 365c972..446b868 100644 --- a/source/smbd/process.c +++ b/source/smbd/process.c @@ -438,6 +438,7 @@ static bool push_queued_message(struct smb_request *req, msg->request_time = request_time; msg->end_time = end_time; msg->encrypted = req->encrypted; + msg->processed = false; if (private_data) { msg->private_data = data_blob_talloc(msg, private_data, @@ -493,6 +494,16 @@ void schedule_deferred_open_smb_message(uint16 mid) DEBUG(10,("schedule_deferred_open_smb_message: [%d] msg_mid = %u\n", i++, (unsigned int)msg_mid )); if (mid == msg_mid) { + + if (pml->processed) { + /* A processed message should not be + * rescheduled. */ + DEBUG(0,("schedule_deferred_open_smb_message: LOGIC ERROR " + "message mid %u was already processed\n", + (unsigned int)msg_mid )); + continue; + } + DEBUG(10,("schedule_deferred_open_smb_message: scheduling mid %u\n", mid )); pml->end_time.tv_sec = 0; @@ -507,7 +518,7 @@ void schedule_deferred_open_smb_message(uint16 mid) } /**************************************************************************** - Return true if this mid is on the deferred queue. + Return true if this mid is on the deferred queue and was not yet processed. ****************************************************************************/ bool open_was_deferred(uint16 mid) @@ -515,7 +526,7 @@ bool open_was_deferred(uint16 mid) struct pending_message_list *pml; for (pml = deferred_open_queue; pml; pml = pml->next) { - if (SVAL(pml->buf.data,smb_mid) == mid) { + if (SVAL(pml->buf.data,smb_mid) == mid && !pml->processed) { return True; } } @@ -784,6 +795,10 @@ static NTSTATUS receive_message_or_smb(TALLOC_CTX *mem_ctx, char **buffer, /* We leave this message on the queue so the open code can know this is a retry. */ DEBUG(5,("receive_message_or_smb: returning deferred open smb message.\n")); + + /* Mark the message as processed so this is not + * re-processed in error. */ + msg->processed = true; return NT_STATUS_OK; } } @@ -1428,7 +1443,6 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req, in if (!change_to_user(conn,session_tag)) { reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid)); - remove_deferred_open_smb_message(req->mid); return conn; } @@ -1493,6 +1507,7 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req, in static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool encrypted) { + struct pending_message_list *pml = NULL; uint8 type = CVAL(inbuf,smb_com); connection_struct *conn; struct smb_request *req; @@ -1508,6 +1523,13 @@ static void construct_reply(char *inbuf, int size, size_t unread_bytes, bool enc conn = switch_message(type, req, size); + /* If this was a deferred message and it's still there and + * was processed, remove it. */ + pml = get_open_deferred_message(req->mid); + if (pml && pml->processed) { + remove_deferred_open_smb_message(req->mid); + } + if (req->unread_bytes) { /* writeX failed. drain socket. */ if (drain_socket(smbd_server_fd(), req->unread_bytes) != diff --git a/source/smbd/service.c b/source/smbd/service.c index 4724dd7..2a1ef20 100644 --- a/source/smbd/service.c +++ b/source/smbd/service.c @@ -55,6 +55,10 @@ bool set_conn_connectpath(connection_struct *conn, const char *connectpath) const char *s = connectpath; bool start_of_name_component = true; + if (connectpath == NULL || connectpath[0] == '\0') { + return false; + } + destname = SMB_STRDUP(connectpath); if (!destname) { return false; @@ -331,7 +335,7 @@ int add_home_service(const char *service, const char *username, const char *home { int iHomeService; - if (!service || !homedir) + if (!service || !homedir || homedir[0] == '\0') return -1; if ((iHomeService = lp_servicenumber(HOMES_NAME)) < 0) { -- Samba Shared Repository