[Pkg-samba-maint] [samba] 11/19: CVE-2015-5252: s3: smbd: Fix symlink verification (file access outside the share).

[Jelmer Vernooij]

This is an automated email from the git hooks/post-receive script.

jelmer pushed a commit to branch upstream_4.3
in repository samba.

commit 4278ef25f64d5fdbf432ff1534e275416ec9561e
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Jul 9 10:58:11 2015 -0700

    CVE-2015-5252: s3: smbd: Fix symlink verification (file access outside the share).
    
    Ensure matching component ends in '/' or '\0'.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=11395
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    Reviewed-by: Volker Lendecke <vl at samba.org>
---
 source3/smbd/vfs.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c
index 9f3ba6d..f14ecbe 100644
--- a/source3/smbd/vfs.c
+++ b/source3/smbd/vfs.c
@@ -982,6 +982,7 @@ NTSTATUS check_reduced_name_with_privilege(connection_struct *conn,
 	struct smb_filename *smb_fname_cwd = NULL;
 	struct privilege_paths *priv_paths = NULL;
 	int ret;
+	bool matched;
 
 	DEBUG(3,("check_reduced_name_with_privilege [%s] [%s]\n",
 			fname,
@@ -1076,7 +1077,10 @@ NTSTATUS check_reduced_name_with_privilege(connection_struct *conn,
 	}
 
 	rootdir_len = strlen(conn_rootdir);
-	if (strncmp(conn_rootdir, resolved_name, rootdir_len) != 0) {
+	matched = (strncmp(conn_rootdir, resolved_name, rootdir_len) == 0);
+
+	if (!matched || (resolved_name[rootdir_len] != '/' &&
+			 resolved_name[rootdir_len] != '\0')) {
 		DEBUG(2, ("check_reduced_name_with_privilege: Bad access "
 			"attempt: %s is a symlink outside the "
 			"share path\n",
@@ -1216,6 +1220,7 @@ NTSTATUS check_reduced_name(connection_struct *conn, const char *fname)
 	if (!allow_widelinks || !allow_symlinks) {
 		const char *conn_rootdir;
 		size_t rootdir_len;
+		bool matched;
 
 		conn_rootdir = SMB_VFS_CONNECTPATH(conn, fname);
 		if (conn_rootdir == NULL) {
@@ -1226,8 +1231,10 @@ NTSTATUS check_reduced_name(connection_struct *conn, const char *fname)
 		}
 
 		rootdir_len = strlen(conn_rootdir);
-		if (strncmp(conn_rootdir, resolved_name,
-				rootdir_len) != 0) {
+		matched = (strncmp(conn_rootdir, resolved_name,
+				rootdir_len) == 0);
+		if (!matched || (resolved_name[rootdir_len] != '/' &&
+				 resolved_name[rootdir_len] != '\0')) {
 			DEBUG(2, ("check_reduced_name: Bad access "
 				"attempt: %s is a symlink outside the "
 				"share path\n", fname));

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-samba/samba.git