Fix bug #7669.

Fix bug #7669 (buffer overflow in sid_parse() in Samba3 and dom_sid_parse in
Samba4).

CVE-2010-3069:

===========
Description
===========

All current released versions of Samba are vulnerable to
a buffer overrun vulnerability. The sid_parse() function
(and related dom_sid_parse() function in the source4 code)
do not correctly check their input lengths when reading a
binary representation of a Windows SID (Security ID). This
allows a malicious client to send a sid that can overflow
the stack variable that is being used to store the SID in the
Samba smbd server.

A connection to a file share is needed to exploit this
vulnerability, either authenticated or unauthenticated
(guest connection).
(cherry picked from commit a34c3e999bb1ea61da31c5b3e845b19663039358)

diff --git a/libcli/security/dom_sid.c b/libcli/security/dom_sid.c
index 0c8890079af7e8d99305fe4e83391e20f8a6af1b..350a14f311b063c5e1cc057a5159eae5e6a8b2a1 100644 (file)
--- a/libcli/security/dom_sid.c
+++ b/libcli/security/dom_sid.c
@@ -117,6 +117,10 @@ bool dom_sid_parse(const char *sidstr, struct dom_sid *ret)
                if (sidstr[i] == '-') num_sub_auths++;
        }
 
+       if (num_sub_auths > MAXSUBAUTHS) {
+               return false;
+       }
+
        ret->sid_rev_num = rev;
        ret->id_auth[0] = 0;
        ret->id_auth[1] = 0;

diff --git a/libcli/security/dom_sid.h b/libcli/security/dom_sid.h
index e89253554e81251faf60616cd56dea2427f3b9fd..748e009117d11a99911c55bb0096673b96978f45 100644 (file)
--- a/libcli/security/dom_sid.h
+++ b/libcli/security/dom_sid.h
@@ -40,5 +40,9 @@ bool dom_sid_in_domain(const struct dom_sid *domain_sid,
                       const struct dom_sid *sid);
 char *dom_sid_string(TALLOC_CTX *mem_ctx, const struct dom_sid *sid);
 
+#ifndef MAXSUBAUTHS
+#define MAXSUBAUTHS 15 /* max sub authorities in a SID */
+#endif
+
 #endif /*_DOM_SID_H_*/
 

diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c
index 639269cac2cdd5514438a910cfe257bb8c31e018..bea04d8c6ee60117d940cb002aa4f2d988764c66 100644 (file)
--- a/source3/lib/util_sid.c
+++ b/source3/lib/util_sid.c
@@ -408,6 +408,9 @@ bool sid_parse(const char *inbuf, size_t len, DOM_SID *sid)
 
        sid->sid_rev_num = CVAL(inbuf, 0);
        sid->num_auths = CVAL(inbuf, 1);
+       if (sid->num_auths > MAXSUBAUTHS) {
+               return false;
+       }
        memcpy(sid->id_auth, inbuf+2, 6);
        if (len < 8 + sid->num_auths*4)
                return False;

diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index 1fd5aa34e352d9e081bdd2e8d014d10ef84dad64..f18ded15d9f5cbb23336865a0c93ebd24454e424 100644 (file)
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -2141,7 +2141,9 @@ static void dump_sid(ADS_STRUCT *ads, const char *field, struct berval **values)
        for (i=0; values[i]; i++) {
                DOM_SID sid;
                fstring tmp;
-               sid_parse(values[i]->bv_val, values[i]->bv_len, &sid);
+               if (!sid_parse(values[i]->bv_val, values[i]->bv_len, &sid)) {
+                       continue;
+               }
                printf("%s: %s\n", field, sid_to_fstring(tmp, &sid));
        }
 }

diff --git a/source3/libsmb/cliquota.c b/source3/libsmb/cliquota.c
index a8b1aa19fd7af9cc533606bbf89407ee7808e77d..37e712d71d12b13a1e57c4e93658d5d35d40c93c 100644 (file)
--- a/source3/libsmb/cliquota.c
+++ b/source3/libsmb/cliquota.c
@@ -111,7 +111,9 @@ static bool parse_user_quota_record(const char *rdata, unsigned int rdata_count,
        }
 #endif /* LARGE_SMB_OFF_T */
 
-       sid_parse(rdata+40,sid_len,&qt.sid);
+       if (!sid_parse(rdata+40,sid_len,&qt.sid)) {
+               return false;
+       }
 
        qt.qtype = SMB_USER_QUOTA_TYPE;
 

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 656375499f5efde690b59170bd3c439e08a247f1..913921357f3ec5e9eada9bea3ace6d9d43608e00 100644 (file)
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -2161,7 +2161,11 @@ static void call_nt_transact_ioctl(connection_struct *conn,
                /* unknown 4 bytes: this is not the length of the sid :-(  */
                /*unknown = IVAL(pdata,0);*/
 
-               sid_parse(pdata+4,sid_len,&sid);
+               if (!sid_parse(pdata+4,sid_len,&sid)) {
+                       reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                       return;
+               }
+
                DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
 
                if (!sid_to_uid(&sid, &uid)) {
@@ -2417,7 +2421,10 @@ static void call_nt_transact_get_user_quota(connection_struct *conn,
                                break;
                        }
 
-                       sid_parse(pdata+8,sid_len,&sid);
+                       if (!sid_parse(pdata+8,sid_len,&sid)) {
+                               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                               return;
+                       }
 
                        if (vfs_get_ntquota(fsp, SMB_USER_QUOTA_TYPE, &sid, &qt)!=0) {
                                ZERO_STRUCT(qt);
@@ -2598,7 +2605,11 @@ static void call_nt_transact_set_user_quota(connection_struct *conn,
        }
 #endif /* LARGE_SMB_OFF_T */
 
-       sid_parse(pdata+40,sid_len,&sid);
+       if (!sid_parse(pdata+40,sid_len,&sid)) {
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               return;
+       }
+
        DEBUGADD(8,("SID: %s\n", sid_string_dbg(&sid)));
 
        /* 44 unknown bytes left... */