[Pkg-samba-maint] r1249 - in branches/sarge: . patches
Christian Perrier
bubulle at alioth.debian.org
Mon Feb 12 22:22:55 CET 2007
Author: bubulle
Date: 2007-02-12 22:22:55 +0100 (Mon, 12 Feb 2007)
New Revision: 1249
Added:
branches/sarge/patches/security-CVE-2007-0454.patch
branches/sarge/patches/security-defer-dos.patch
Modified:
branches/sarge/changelog
Log:
Update to 3.0.14a-3sarge4
Modified: branches/sarge/changelog
===================================================================
--- branches/sarge/changelog 2007-02-12 21:18:19 UTC (rev 1248)
+++ branches/sarge/changelog 2007-02-12 21:22:55 UTC (rev 1249)
@@ -1,3 +1,17 @@
+samba (3.0.14a-3sarge4) stable-security; urgency=high
+
+ * Update endless-loop DoS fix to cover another attack vector.
+
+ -- Moritz Muehlenhoff <jmm at debian.org> Wed, 31 Jan 2007 20:28:40 +0000
+
+samba (3.0.14a-3sarge3) stable-security; urgency=high
+
+ * Non-maintainer upload by the Security Team:
+ Fix format string vulnerability in afsacl.so VFS plugin (CVE-2007-0454)
+ Fix endless-loop DoS in deferred open
+
+ -- Moritz Muehlenhoff <jmm at debian.org> Tue, 30 Jan 2007 21:36:42 +0100
+
samba (3.0.14a-3sarge2) stable-security; urgency=high
* Non-maintainer upload by the Security Team:
Added: branches/sarge/patches/security-CVE-2007-0454.patch
===================================================================
--- branches/sarge/patches/security-CVE-2007-0454.patch 2007-02-12 21:18:19 UTC (rev 1248)
+++ branches/sarge/patches/security-CVE-2007-0454.patch 2007-02-12 21:22:55 UTC (rev 1249)
@@ -0,0 +1,13 @@
+diff -urN samba-3.0.23d/source/modules/vfs_afsacl.c samba/source/modules/vfs_afsacl.c
+--- samba-3.0.23d/source/modules/vfs_afsacl.c 2006-06-23 08:16:50.000000000 -0500
++++ samba-3.0.14a/source/modules/vfs_afsacl.c 2007-01-29 20:11:07.000000000 -0600
+@@ -901,7 +901,7 @@
+ ZERO_STRUCT(dir_acl);
+ ZERO_STRUCT(file_acl);
+
+- pstr_sprintf(name, fsp->fsp_name);
++ pstrcpy(name, fsp->fsp_name);
+
+ if (!fsp->is_directory) {
+ /* We need to get the name of the directory containing the
+
Added: branches/sarge/patches/security-defer-dos.patch
===================================================================
--- branches/sarge/patches/security-defer-dos.patch 2007-02-12 21:18:19 UTC (rev 1248)
+++ branches/sarge/patches/security-defer-dos.patch 2007-02-12 21:22:55 UTC (rev 1249)
@@ -0,0 +1,241 @@
+diff -aur samba-3.0.14a.orig/source/printing/nt_printing.c samba-3.0.14a/source/printing/nt_printing.c
+--- samba-3.0.14a.orig/source/printing/nt_printing.c 2005-04-14 08:14:20.000000000 +0200
++++ samba-3.0.14a/source/printing/nt_printing.c 2007-01-31 12:15:02.000000000 +0100
+@@ -1526,12 +1526,12 @@
+ DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
+ new_name, old_name));
+ *perr = ntstatus_to_werror(status);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ ver = -1;
+ }
+ } else {
+ driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ }
+ }
+
+@@ -1547,12 +1547,12 @@
+ DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
+ new_name, old_name));
+ *perr = ntstatus_to_werror(status);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ ver = -1;
+ }
+ } else {
+ driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ }
+ }
+ }
+@@ -1570,12 +1570,12 @@
+ DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
+ new_name, old_name));
+ *perr = ntstatus_to_werror(status);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ ver = -1;
+ }
+ } else {
+ driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ }
+ }
+ }
+@@ -1594,12 +1594,12 @@
+ DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
+ new_name, old_name));
+ *perr = ntstatus_to_werror(status);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ ver = -1;
+ }
+ } else {
+ driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ }
+ }
+ }
+@@ -1627,12 +1627,12 @@
+ DEBUG(0,("move_driver_to_download_area: Unable to rename [%s] to [%s]\n",
+ new_name, old_name));
+ *perr = ntstatus_to_werror(status);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ ver = -1;
+ }
+ } else {
+ driver_unix_convert(new_name, conn, NULL, &bad_path, &st);
+- unlink_internals(conn, 0, new_name);
++ unlink_internals(conn, 0, new_name, False);
+ }
+ }
+ NextDriver: ;
+@@ -4644,7 +4644,7 @@
+ if ( (s = strchr( &info_3->driverpath[1], '\\' )) != NULL ) {
+ driver_unix_convert(s, conn, NULL, &bad_path, &st);
+ DEBUG(10,("deleting driverfile [%s]\n", s));
+- unlink_internals(conn, 0, s);
++ unlink_internals(conn, 0, s, False);
+ }
+ }
+
+@@ -4652,7 +4652,7 @@
+ if ( (s = strchr( &info_3->configfile[1], '\\' )) != NULL ) {
+ driver_unix_convert(s, conn, NULL, &bad_path, &st);
+ DEBUG(10,("deleting configfile [%s]\n", s));
+- unlink_internals(conn, 0, s);
++ unlink_internals(conn, 0, s, False);
+ }
+ }
+
+@@ -4660,7 +4660,7 @@
+ if ( (s = strchr( &info_3->datafile[1], '\\' )) != NULL ) {
+ driver_unix_convert(s, conn, NULL, &bad_path, &st);
+ DEBUG(10,("deleting datafile [%s]\n", s));
+- unlink_internals(conn, 0, s);
++ unlink_internals(conn, 0, s, False);
+ }
+ }
+
+@@ -4668,7 +4668,7 @@
+ if ( (s = strchr( &info_3->helpfile[1], '\\' )) != NULL ) {
+ driver_unix_convert(s, conn, NULL, &bad_path, &st);
+ DEBUG(10,("deleting helpfile [%s]\n", s));
+- unlink_internals(conn, 0, s);
++ unlink_internals(conn, 0, s, False);
+ }
+ }
+
+@@ -4683,7 +4683,7 @@
+ if ( (file = strchr( info_3->dependentfiles[i]+1, '\\' )) != NULL ) {
+ driver_unix_convert(file, conn, NULL, &bad_path, &st);
+ DEBUG(10,("deleting dependent file [%s]\n", file));
+- unlink_internals(conn, 0, file );
++ unlink_internals(conn, 0, file, False);
+ }
+
+ i++;
+Only in samba-3.0.14a/source/printing: nt_printing.c~
+diff -aur samba-3.0.14a.orig/source/smbd/nttrans.c samba-3.0.14a/source/smbd/nttrans.c
+--- samba-3.0.14a.orig/source/smbd/nttrans.c 2005-04-14 08:14:20.000000000 +0200
++++ samba-3.0.14a/source/smbd/nttrans.c 2007-01-31 12:16:43.000000000 +0100
+@@ -790,7 +790,7 @@
+ /* Setting FILE_SHARE_DELETE is the hint. */
+ if ((share_access & FILE_SHARE_DELETE) && (desired_access & DELETE_ACCESS)) {
+ #endif
+- status = can_delete(conn, fname, file_attributes, bad_path, True);
++ status = can_delete(conn, fname, file_attributes, bad_path, True, False);
+ /* We're only going to fail here if it's access denied, as that's the
+ only error we care about for "can we delete this ?" questions. */
+ if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
+@@ -1350,7 +1350,7 @@
+ /* Setting FILE_SHARE_DELETE is the hint. */
+ if ((share_access & FILE_SHARE_DELETE) && (desired_access & DELETE_ACCESS)) {
+ #endif
+- status = can_delete(conn, fname, file_attributes, bad_path, True);
++ status = can_delete(conn, fname, file_attributes, bad_path, True, False);
+ /* We're only going to fail here if it's access denied, as that's the
+ only error we care about for "can we delete this ?" questions. */
+ if (!NT_STATUS_IS_OK(status) && (NT_STATUS_EQUAL(status,NT_STATUS_ACCESS_DENIED) ||
+@@ -1882,8 +1882,14 @@
+
+ status = rename_internals(conn, fsp->fsp_name,
+ new_name, 0, replace_if_exists);
+- if (!NT_STATUS_IS_OK(status))
++
++ if (!NT_STATUS_IS_OK(status)) {
++ if (open_was_deferred(SVAL(inbuf,smb_mid))) {
++ /* We have re-scheduled this call. */
++ return -1;
++ }
+ return ERROR_NT(status);
++ }
+
+ /*
+ * Rename was successful.
+Only in samba-3.0.14a/source/smbd: nttrans.c.orig
+Only in samba-3.0.14a/source/smbd: nttrans.c~
+diff -aur samba-3.0.14a.orig/source/smbd/reply.c samba-3.0.14a/source/smbd/reply.c
+--- samba-3.0.14a.orig/source/smbd/reply.c 2005-04-14 08:14:20.000000000 +0200
++++ samba-3.0.14a/source/smbd/reply.c 2007-01-31 12:12:12.000000000 +0100
+@@ -1490,7 +1490,7 @@
+ Check if a user is allowed to delete a file.
+ ********************************************************************/
+
+-NTSTATUS can_delete(connection_struct *conn, char *fname, int dirtype, BOOL bad_path, BOOL check_is_at_open)
++NTSTATUS can_delete(connection_struct *conn, char *fname, int dirtype, BOOL bad_path, BOOL check_is_at_open, BOOL can_defer)
+ {
+ SMB_STRUCT_STAT sbuf;
+ int fmode;
+@@ -1544,7 +1544,7 @@
+ unix_ERR_code = 0;
+
+ fsp = open_file_shared1(conn, fname, &sbuf, DELETE_ACCESS, SET_DENY_MODE(DENY_ALL),
+- (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, 0, &access_mode, &smb_action);
++ (FILE_FAIL_IF_NOT_EXIST|FILE_EXISTS_OPEN), FILE_ATTRIBUTE_NORMAL, can_defer ? 0 : INTERNAL_OPEN_ONLY, &access_mode, &smb_action);
+
+ if (!fsp) {
+ NTSTATUS ret = NT_STATUS_ACCESS_DENIED;
+@@ -1567,7 +1567,7 @@
+ code.
+ ****************************************************************************/
+
+-NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name)
++NTSTATUS unlink_internals(connection_struct *conn, int dirtype, char *name, BOOL can_defer)
+ {
+ pstring directory;
+ pstring mask;
+@@ -1618,7 +1618,7 @@
+ if (!has_wild) {
+ pstrcat(directory,"/");
+ pstrcat(directory,mask);
+- error = can_delete(conn,directory,dirtype,bad_path,False);
++ error = can_delete(conn,directory,dirtype,bad_path,False,can_defer);
+ if (!NT_STATUS_IS_OK(error))
+ return error;
+
+@@ -1676,7 +1676,7 @@
+ }
+
+ slprintf(fname,sizeof(fname)-1, "%s/%s",directory,dname);
+- error = can_delete(conn,fname,dirtype,bad_path,False);
++ error = can_delete(conn,fname,dirtype,bad_path,False,False);
+ if (!NT_STATUS_IS_OK(error)) {
+ continue;
+ }
+@@ -1720,7 +1720,7 @@
+
+ DEBUG(3,("reply_unlink : %s\n",name));
+
+- status = unlink_internals(conn, dirtype, name);
++ status = unlink_internals(conn, dirtype, name, True);
+ if (!NT_STATUS_IS_OK(status)) {
+ if (open_was_deferred(SVAL(inbuf,smb_mid))) {
+ /* We have re-scheduled this call. */
+Only in samba-3.0.14a/source/smbd: reply.c~
+diff -aur samba-3.0.14a.orig/source/smbd/trans2.c samba-3.0.14a/source/smbd/trans2.c
+--- samba-3.0.14a.orig/source/smbd/trans2.c 2005-04-14 08:14:20.000000000 +0200
++++ samba-3.0.14a/source/smbd/trans2.c 2007-01-31 12:16:43.000000000 +0100
+@@ -3771,9 +3771,15 @@
+ fname, newname ));
+ status = rename_internals(conn, fname, base_name, 0, overwrite);
+ }
++
+ if (!NT_STATUS_IS_OK(status)) {
++ if (open_was_deferred(SVAL(inbuf,smb_mid))) {
++ /* We have re-scheduled this call. */
++ return -1;
++ }
+ return ERROR_NT(status);
+ }
++
+ process_pending_change_notify_queue((time_t)0);
+ SSVAL(params,0,0);
+ send_trans2_replies(outbuf, bufsize, params, 2, *ppdata, 0);
+Only in samba-3.0.14a/source/smbd: trans2.c.orig
More information about the Pkg-samba-maint
mailing list