1
0

011-patch-cve-2015-5296.patch 2.9 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788
  1. From 25139116756cc285a3a5534834cc276ef1b7baaa Mon Sep 17 00:00:00 2001
  2. From: Stefan Metzmacher <metze@samba.org>
  3. Date: Wed, 30 Sep 2015 21:17:02 +0200
  4. Subject: [PATCH 1/2] CVE-2015-5296: s3:libsmb: force signing when requiring
  5. encryption in do_connect()
  6. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11536
  7. Signed-off-by: Stefan Metzmacher <metze@samba.org>
  8. Reviewed-by: Jeremy Allison <jra@samba.org>
  9. ---
  10. source3/libsmb/clidfs.c | 7 ++++++-
  11. 1 file changed, 6 insertions(+), 1 deletion(-)
  12. --- a/source3/libsmb/clidfs.c
  13. +++ b/source3/libsmb/clidfs.c
  14. @@ -98,6 +98,11 @@ static struct cli_state *do_connect(TALL
  15. const char *username;
  16. const char *password;
  17. NTSTATUS status;
  18. + int signing_state = get_cmdline_auth_info_signing_state(auth_info);
  19. +
  20. + if (force_encrypt) {
  21. + signing_state = Required;
  22. + }
  23. /* make a copy so we don't modify the global string 'service' */
  24. servicename = talloc_strdup(ctx,share);
  25. @@ -132,7 +137,7 @@ static struct cli_state *do_connect(TALL
  26. zero_sockaddr(&ss);
  27. /* have to open a new connection */
  28. - c = cli_initialise_ex(get_cmdline_auth_info_signing_state(auth_info));
  29. + c = cli_initialise_ex(signing_state);
  30. if (c == NULL) {
  31. d_printf("Connection to %s failed\n", server_n);
  32. return NULL;
  33. --- a/source3/libsmb/libsmb_server.c
  34. +++ b/source3/libsmb/libsmb_server.c
  35. @@ -258,6 +258,7 @@ SMBC_server_internal(TALLOC_CTX *ctx,
  36. const char *username_used;
  37. NTSTATUS status;
  38. char *newserver, *newshare;
  39. + int signing_state = Undefined;
  40. zero_sockaddr(&ss);
  41. ZERO_STRUCT(c);
  42. @@ -404,8 +405,12 @@ again:
  43. zero_sockaddr(&ss);
  44. + if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
  45. + signing_state = Required;
  46. + }
  47. +
  48. /* have to open a new connection */
  49. - if ((c = cli_initialise()) == NULL) {
  50. + if ((c = cli_initialise_ex(signing_state)) == NULL) {
  51. errno = ENOMEM;
  52. return NULL;
  53. }
  54. @@ -750,6 +755,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,
  55. ipc_srv = SMBC_find_server(ctx, context, server, "*IPC$",
  56. pp_workgroup, pp_username, pp_password);
  57. if (!ipc_srv) {
  58. + int signing_state = Undefined;
  59. /* We didn't find a cached connection. Get the password */
  60. if (!*pp_password || (*pp_password)[0] == '\0') {
  61. @@ -771,6 +777,9 @@ SMBC_attr_server(TALLOC_CTX *ctx,
  62. if (smbc_getOptionUseCCache(context)) {
  63. flags |= CLI_FULL_CONNECTION_USE_CCACHE;
  64. }
  65. + if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
  66. + signing_state = Required;
  67. + }
  68. zero_sockaddr(&ss);
  69. nt_status = cli_full_connection(&ipc_cli,
  70. @@ -780,7 +789,7 @@ SMBC_attr_server(TALLOC_CTX *ctx,
  71. *pp_workgroup,
  72. *pp_password,
  73. flags,
  74. - Undefined);
  75. + signing_state);
  76. if (! NT_STATUS_IS_OK(nt_status)) {
  77. DEBUG(1,("cli_full_connection failed! (%s)\n",
  78. nt_errstr(nt_status)));