diff options
| author | Jeremy Allison <jra@samba.org> | 2010-09-09 15:48:23 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2010-09-15 20:55:14 +0200 |
| commit | bb3dc1edc91e5fb5c9404ba49b0405a23b4ecb74 (patch) | |
| tree | 965dd33005391e78355dbcca674f0765e05599f3 /libcli | |
| parent | 995e7e500327e662b7ef2b37c83c92e75f2360bf (diff) | |
| download | samba-bb3dc1edc91e5fb5c9404ba49b0405a23b4ecb74.tar.gz samba-bb3dc1edc91e5fb5c9404ba49b0405a23b4ecb74.tar.xz samba-bb3dc1edc91e5fb5c9404ba49b0405a23b4ecb74.zip | |
Fix bug #7669.
Fix bug #7669 (buffer overflow in sid_parse() in Samba3 and dom_sid_parse in
Samba4).
CVE-2010-3069:
===========
Description
===========
All current released versions of Samba are vulnerable to
a buffer overrun vulnerability. The sid_parse() function
(and related dom_sid_parse() function in the source4 code)
do not correctly check their input lengths when reading a
binary representation of a Windows SID (Security ID). This
allows a malicious client to send a sid that can overflow
the stack variable that is being used to store the SID in the
Samba smbd server.
A connection to a file share is needed to exploit this
vulnerability, either authenticated or unauthenticated
(guest connection).
(cherry picked from commit df20a300758bc12286820e31fcf573bdfc2147bc)
Diffstat (limited to 'libcli')
| -rw-r--r-- | libcli/security/dom_sid.c | 4 | ||||
| -rw-r--r-- | libcli/security/dom_sid.h | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/libcli/security/dom_sid.c b/libcli/security/dom_sid.c index 0c8890079af..350a14f311b 100644 --- a/libcli/security/dom_sid.c +++ b/libcli/security/dom_sid.c @@ -117,6 +117,10 @@ bool dom_sid_parse(const char *sidstr, struct dom_sid *ret) if (sidstr[i] == '-') num_sub_auths++; } + if (num_sub_auths > MAXSUBAUTHS) { + return false; + } + ret->sid_rev_num = rev; ret->id_auth[0] = 0; ret->id_auth[1] = 0; diff --git a/libcli/security/dom_sid.h b/libcli/security/dom_sid.h index e89253554e8..748e009117d 100644 --- a/libcli/security/dom_sid.h +++ b/libcli/security/dom_sid.h @@ -40,5 +40,9 @@ bool dom_sid_in_domain(const struct dom_sid *domain_sid, const struct dom_sid *sid); char *dom_sid_string(TALLOC_CTX *mem_ctx, const struct dom_sid *sid); +#ifndef MAXSUBAUTHS +#define MAXSUBAUTHS 15 /* max sub authorities in a SID */ +#endif + #endif /*_DOM_SID_H_*/ |