The branch, v3-6-stable has been updated
via f7c3d29 WHATSNEW: Add release notes for Samba 3.6.25.
via a470a8a auth: Make sure that creds_out is initialized with NULL.
via 3504106 s3-netlogon: Make sure we do not deference a NULL pointer.
via 4661fa5 CVE-2015-0240: s3: netlogon: Ensure we don't call
talloc_free on an uninitialized pointer.
from 6e1ba4c CVE-2014-0178 patch for 3.6
https://git.samba.org/?p=samba.git;a=shortlog;h=v3-6-stable
- Log -----------------------------------------------------------------
commit f7c3d2984be6aaae711ff144e929b5e5dc98a03e
Author: Karolin Seeger <[email protected]>
Date: Sun Feb 22 15:11:32 2015 +0100
WHATSNEW: Add release notes for Samba 3.6.25.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077
CVE-2015-0240: talloc free on uninitialized stack pointer in netlogon server
could lead to security vulnerability.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=10549
CVE-2014-0178: Malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response
Signed-off-by: Karolin Seeger <[email protected]>
commit a470a8ae13abca48e5887fac463430cc78bccfea
Author: Andreas Schneider <[email protected]>
Date: Mon Feb 16 10:56:03 2015 +0100
auth: Make sure that creds_out is initialized with NULL.
This is an additional patch for CVE-2015-0240.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077#c32
Pair-Programmed-With: Michael Adam <[email protected]>
Pair-Programmed-With: Andreas Schneider <[email protected]>
Signed-off-by: Michael Adam <[email protected]>
Signed-off-by: Andreas Schneider <[email protected]>
Reviewed-by: Volker Lendecke <[email protected]>
commit 3504106c94153a87c5c8e1c0e49f1fff924b0f4d
Author: Andreas Schneider <[email protected]>
Date: Mon Feb 16 10:59:23 2015 +0100
s3-netlogon: Make sure we do not deference a NULL pointer.
This is an additional patch for CVE-2015-0240.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077#c32
Pair-Programmed-With: Michael Adam <[email protected]>
Pair-Programmed-With: Andreas Schneider <[email protected]>
Signed-off-by: Michael Adam <[email protected]>
Signed-off-by: Andreas Schneider <[email protected]>
Reviewed-by: Volker Lendecke <[email protected]>
commit 4661fa51de4915c96eeb61a74982519076a02c9b
Author: Jeremy Allison <[email protected]>
Date: Wed Jan 28 14:47:31 2015 -0800
CVE-2015-0240: s3: netlogon: Ensure we don't call talloc_free on an
uninitialized pointer.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11077
Signed-off-by: Jeremy Allison <[email protected]>
Reviewed-by: Stefan Metzmacher <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
WHATSNEW.txt | 76 ++++++++++++++++++++++++++++-
libcli/auth/schannel_state_tdb.c | 4 ++
source3/rpc_server/netlogon/srv_netlog_nt.c | 13 ++++-
3 files changed, 89 insertions(+), 4 deletions(-)
Changeset truncated at 500 lines:
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index aa57ee5..795b7c9 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,76 @@
==============================
+ Release Notes for Samba 3.6.25
+ February 23, 2015
+ ==============================
+
+
+This is a security release in order to address CVE-2015-0240 (Unexpected
+code execution in smbd).
+
+o CVE-2015-0240:
+ All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an
+ unexpected code execution vulnerability in the smbd file server
+ daemon.
+
+ A malicious client could send packets that may set up the stack in
+ such a way that the freeing of memory in a subsequent anonymous
+ netlogon packet could allow execution of arbitrary code. This code
+ would execute with root privileges.
+
+o CVE-2014-0178:
+ In preparing a response to an authenticated FSCTL_GET_SHADOW_COPY_DATA
+ or FSCTL_SRV_ENUMERATE_SNAPSHOTS client request, affected versions of
+ Samba do not initialize 8 bytes of the 16 byte SRV_SNAPSHOT_ARRAY
+ response field. The uninitialized buffer is sent back to the client.
+
+ A non-default VFS module providing the get_shadow_copy_data_fn() hook
+ must be explicitly enabled for Samba to process the aforementioned
+ client requests. Therefore, only configurations with "shadow_copy" or
+ "shadow_copy2" specified for the "vfs objects" parameter are vulnerable.
+
+
+Changes since 3.6.24:
+---------------------
+
+o Jeremy Allison <[email protected]>
+ * BUG 11077: CVE-2015-0240: talloc free on uninitialized stack pointer
+ in netlogon server could lead to security vulnerability.
+
+
+o Jiří Šašek <[email protected]>
+ * BUG 10549: CVE-2014-0178: Fix malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS
+ response.
+
+
+o Andreas Schneider <[email protected]>
+ * BUG 11077: CVE-2015-0240: s3-netlogon: Make sure we do not deference
+ a NULL pointer./auth: Make sure that creds_out is initialized with NULL.
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 3.6 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
+ ==============================
Release Notes for Samba 3.6.24
June 23, 2014
==============================
@@ -52,8 +124,8 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
==============================
Release Notes for Samba 3.6.23
diff --git a/libcli/auth/schannel_state_tdb.c b/libcli/auth/schannel_state_tdb.c
index ca35a11..145005c 100644
--- a/libcli/auth/schannel_state_tdb.c
+++ b/libcli/auth/schannel_state_tdb.c
@@ -285,6 +285,10 @@ NTSTATUS schannel_check_creds_state(TALLOC_CTX *mem_ctx,
NTSTATUS status;
int ret;
+ if (creds_out != NULL) {
+ *creds_out = NULL;
+ }
+
tmpctx = talloc_named(mem_ctx, 0, "schannel_check_creds_state");
if (!tmpctx) {
return NT_STATUS_NO_MEMORY;
diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c
b/source3/rpc_server/netlogon/srv_netlog_nt.c
index 3b1cdcf..060ca0b 100644
--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
@@ -1070,6 +1070,10 @@ static NTSTATUS netr_creds_server_step_check(struct
pipes_struct *p,
NTSTATUS status;
bool schannel_global_required = (lp_server_schannel() == true) ?
true:false;
+ if (creds_out != NULL) {
+ *creds_out = NULL;
+ }
+
if (schannel_global_required) {
status = schannel_check_required(&p->auth,
computer_name,
@@ -1205,7 +1209,7 @@ NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p,
{
NTSTATUS status = NT_STATUS_OK;
int i;
- struct netlogon_creds_CredentialState *creds;
+ struct netlogon_creds_CredentialState *creds = NULL;
DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
@@ -1218,9 +1222,14 @@ NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p,
unbecome_root();
if (!NT_STATUS_IS_OK(status)) {
+ const char *computer_name = "<unknown>";
+
+ if (creds != NULL && creds->computer_name != NULL) {
+ computer_name = creds->computer_name;
+ }
DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step
failed. Rejecting auth "
"request from client %s machine account %s\n",
- r->in.computer_name, creds->computer_name));
+ r->in.computer_name, computer_name));
TALLOC_FREE(creds);
return status;
}
--
Samba Shared Repository
