OpenWrt – Rev 1

Subversion Repositories:
Rev:
From 8e49de7754f7171a58a1f94dee0f1138dbee3c60 Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Fri, 23 Oct 2015 14:54:31 -0700
Subject: [PATCH] CVE-2015-5299: s3-shadow-copy2: fix missing access check on
 snapdir

Fix originally from <partha@exablox.com>

https://bugzilla.samba.org/show_bug.cgi?id=11529

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
---
 source3/modules/vfs_shadow_copy2.c | 47 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

--- a/source3/modules/vfs_shadow_copy2.c
+++ b/source3/modules/vfs_shadow_copy2.c
@@ -21,6 +21,8 @@
 
 #include "includes.h"
 #include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "../libcli/security/security.h"
 #include "system/filesys.h"
 #include "ntioctl.h"
 
@@ -764,6 +766,43 @@ static int shadow_copy2_mkdir(vfs_handle
         SHADOW2_NEXT(MKDIR, (handle, name, mode), int, -1);
 }
 
+static bool check_access_snapdir(struct vfs_handle_struct *handle,
+                               const char *path)
+{
+       struct smb_filename smb_fname;
+       int ret;
+       NTSTATUS status;
+       uint32_t access_granted = 0;
+
+       ZERO_STRUCT(smb_fname);
+       smb_fname.base_name = talloc_asprintf(talloc_tos(),
+                                               "%s",
+                                               path);
+       if (smb_fname.base_name == NULL) {
+               return false;
+       }
+
+       ret = SMB_VFS_NEXT_STAT(handle, &smb_fname);
+       if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) {
+               TALLOC_FREE(smb_fname.base_name);
+               return false;
+       }
+
+       status = smbd_check_open_rights(handle->conn,
+                                       &smb_fname,
+                                       SEC_DIR_LIST,
+                                       &access_granted);
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(0,("user does not have list permission "
+                       "on snapdir %s\n",
+                       smb_fname.base_name));
+               TALLOC_FREE(smb_fname.base_name);
+               return false;
+       }
+       TALLOC_FREE(smb_fname.base_name);
+       return true;
+}
+
 static int shadow_copy2_rmdir(vfs_handle_struct *handle,  const char *fname)
 {
         SHADOW2_NEXT(RMDIR, (handle, name), int, -1);
@@ -877,6 +916,7 @@ static int shadow_copy2_get_shadow_copy2
        SMB_STRUCT_DIRENT *d;
        TALLOC_CTX *tmp_ctx = talloc_new(handle->data);
        char *snapshot;
+       bool ret;
 
        snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle);
        if (snapdir == NULL) {
@@ -886,6 +926,13 @@ static int shadow_copy2_get_shadow_copy2
                talloc_free(tmp_ctx);
                return -1;
        }
+       ret = check_access_snapdir(handle, snapdir);
+       if (!ret) {
+               DEBUG(0,("access denied on listing snapdir %s\n", snapdir));
+               errno = EACCES;
+               talloc_free(tmp_ctx);
+               return -1;
+       }
 
        p = SMB_VFS_NEXT_OPENDIR(handle, snapdir, NULL, 0);