The branch, v3-6-stable has been updated
via 1aef3fb WHATSNEW: Add release notes for Samba 3.6.24.
via 1692ff4 s3: smbd - fix processing of packets with invalid DOS
charset conversions.
via 331ae42 s3: nmbd: Fix bug 10633 - nmbd denial of service
from 3b5dcee VERSION: Bump version number up to 3.6.24.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-6-stable
- Log -----------------------------------------------------------------
commit 1aef3fb9c8f1b5b5bb6a53ed6c4d33ec59d3360a
Author: Karolin Seeger <[email protected]>
Date: Mon Jun 23 08:03:27 2014 +0200
WHATSNEW: Add release notes for Samba 3.6.24.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10633
CVE-2014-0244: nmbd denial of service
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10654
CVE-2014-3493: Segmentation fault in smbd_marshall_dir_entry()'s
SMB_FIND_FILE_UNIX handler because push_ascii() has returned(uint32_t)-1
via srvstr_push(), incrementing p by 4GB
Signed-off-by: Karolin Seeger <[email protected]>
commit 1692ff43ac2e8997dcccd63f2327b7141f5be878
Author: Jeremy Allison <[email protected]>
Date: Wed Jun 11 13:22:14 2014 -0700
s3: smbd - fix processing of packets with invalid DOS charset conversions.
Bug 10654 - Segmentation fault in smbd_marshall_dir_entry()'s
SMB_FIND_FILE_UNIX handler
https://bugzilla.samba.org/show_bug.cgi?id=10654
Signed-off-by: Jeremy Allison <[email protected]>
CVE-2014-3493
commit 331ae420e9fc10b56b3abdcda1c5d98f18f017d4
Author: Jeremy Allison <[email protected]>
Date: Wed May 28 10:40:27 2014 -0700
s3: nmbd: Fix bug 10633 - nmbd denial of service
The Linux kernel has a bug in that it can give spurious
wakeups on a non-blocking UDP socket for a non-deliverable packet.
When nmbd was changed to use non-blocking sockets it
became vulnerable to a spurious wakeup from poll/epoll.
Fix sys_recvfile() to return on EWOULDBLOCK/EAGAIN.
CVE-2014-0244
Signed-off-by: Jeremy Allison <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
WHATSNEW.txt | 61 +++++++++++++++++++++++++++++++++++++++++++++-
source3/lib/charcnv.c | 16 +++++++----
source3/lib/system.c | 7 +----
source3/libsmb/clirap.c | 4 +-
source3/smbd/lanman.c | 4 +-
5 files changed, 75 insertions(+), 17 deletions(-)
Changeset truncated at 500 lines:
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 717b7ce..aa57ee5 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,61 @@
==============================
+ Release Notes for Samba 3.6.24
+ June 23, 2014
+ ==============================
+
+
+This is a security release in order to address
+CVE-2014-0244 (Denial of service - CPU loop) and
+CVE-2014-3493 (Denial of service - Server crash/memory corruption).
+
+o CVE-2014-0244:
+ All current released versions of Samba are vulnerable to a denial of
+ service on the nmbd NetBIOS name services daemon. A malformed packet
+ can cause the nmbd server to loop the CPU and prevent any further
+ NetBIOS name service.
+
+ This flaw is not exploitable beyond causing the code to loop expending
+ CPU resources.
+
+o CVE-2014-3493:
+ All current released versions of Samba are affected by a denial of service
+ crash involving overwriting memory on an authenticated connection to the
+ smbd file server.
+
+
+Changes since 3.6.22:
+---------------------
+
+o Jeremy Allison <[email protected]>
+ * BUG 10633: CVE-2014-0244: Fix nmbd denial of service.
+ * BUG 10654: CVE-2014-3493: Fix segmentation fault in
+ smbd_marshall_dir_entry()'s SMB_FIND_FILE_UNIX handler.
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 3.6 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
+ ==============================
Release Notes for Samba 3.6.23
March 11, 2014
==============================
@@ -49,8 +106,8 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
==============================
Release Notes for Samba 3.6.22
diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c
index d3f65ca..d8cd2a5 100644
--- a/source3/lib/charcnv.c
+++ b/source3/lib/charcnv.c
@@ -822,7 +822,7 @@ size_t ucs2_align(const void *base_ptr, const void *p, int
flags)
**/
size_t push_ascii(void *dest, const char *src, size_t dest_len, int flags)
{
- size_t src_len = strlen(src);
+ size_t src_len = 0;
char *tmpbuf = NULL;
size_t ret;
@@ -840,17 +840,21 @@ size_t push_ascii(void *dest, const char *src, size_t
dest_len, int flags)
src = tmpbuf;
}
+ src_len = strlen(src);
if (flags & (STR_TERMINATE | STR_TERMINATE_ASCII)) {
src_len++;
}
ret = convert_string(CH_UNIX, CH_DOS, src, src_len, dest, dest_len,
True);
- if (ret == (size_t)-1 &&
- (flags & (STR_TERMINATE | STR_TERMINATE_ASCII))
- && dest_len > 0) {
- ((char *)dest)[0] = '\0';
- }
+
SAFE_FREE(tmpbuf);
+ if (ret == (size_t)-1) {
+ if ((flags & (STR_TERMINATE | STR_TERMINATE_ASCII))
+ && dest_len > 0) {
+ ((char *)dest)[0] = '\0';
+ }
+ return 0;
+ }
return ret;
}
diff --git a/source3/lib/system.c b/source3/lib/system.c
index d0e34bc..8f919e5 100644
--- a/source3/lib/system.c
+++ b/source3/lib/system.c
@@ -278,6 +278,7 @@ ssize_t sys_recv(int fd, void *buf, size_t count, int flags)
/*******************************************************************
A recvfrom wrapper that will deal with EINTR.
+NB. As used with non-blocking sockets, return on EAGAIN/EWOULDBLOCK
********************************************************************/
ssize_t sys_recvfrom(int s, void *buf, size_t len, int flags, struct sockaddr
*from, socklen_t *fromlen)
@@ -286,11 +287,7 @@ ssize_t sys_recvfrom(int s, void *buf, size_t len, int
flags, struct sockaddr *f
do {
ret = recvfrom(s, buf, len, flags, from, fromlen);
-#if defined(EWOULDBLOCK)
- } while (ret == -1 && (errno == EINTR || errno == EAGAIN || errno ==
EWOULDBLOCK));
-#else
- } while (ret == -1 && (errno == EINTR || errno == EAGAIN));
-#endif
+ } while (ret == -1 && (errno == EINTR));
return ret;
}
diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c
index d39d38e..31c4cfe 100644
--- a/source3/libsmb/clirap.c
+++ b/source3/libsmb/clirap.c
@@ -319,7 +319,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char
*workgroup, uint32 stype,
sizeof(param) - PTR_DIFF(p,param) - 1,
STR_TERMINATE|STR_UPPER);
- if (len == (size_t)-1) {
+ if (len == 0) {
SAFE_FREE(last_entry);
return false;
}
@@ -331,7 +331,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char
*workgroup, uint32 stype,
sizeof(param) - PTR_DIFF(p,param) - 1,
STR_TERMINATE);
- if (len == (size_t)-1) {
+ if (len == 0) {
SAFE_FREE(last_entry);
return false;
}
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 3b4ec65..0f5d6da 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -128,7 +128,7 @@ static int CopyExpanded(connection_struct *conn,
return 0;
}
l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
- if (l == -1) {
+ if (l == 0) {
return 0;
}
(*dst) += l;
@@ -143,7 +143,7 @@ static int CopyAndAdvance(char **dst, char *src, int *n)
return 0;
}
l = push_ascii(*dst,src,*n, STR_TERMINATE);
- if (l == -1) {
+ if (l == 0) {
return 0;
}
(*dst) += l;
--
Samba Shared Repository
