From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 7 Jul 2015 14:06:59 +0000 (+0200)
Subject: CVE-2015-5370: s3:rpc_server: use 'alter' instead of 'bind' for variables in api_pipe... 
X-Git-Tag: samba-4.2.10~24
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cdefee174d2f8920323e9e62966df4f4ced49ed3;p=thirdparty%2Fsamba.git

CVE-2015-5370: s3:rpc_server: use 'alter' instead of 'bind' for variables in api_pipe_alter_context()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11344

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
---

diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 3b36a2a6213..3b746cf515b 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -976,7 +976,7 @@ static bool api_pipe_alter_context(struct pipes_struct *p,
 	uint16_t assoc_gid;
 	NTSTATUS status;
 	union dcerpc_payload u;
-	struct dcerpc_ack_ctx bind_ack_ctx;
+	struct dcerpc_ack_ctx alter_ack_ctx;
 	DATA_BLOB auth_resp = data_blob_null;
 	DATA_BLOB auth_blob = data_blob_null;
 	struct gensec_security *gensec_security;
@@ -988,8 +988,8 @@ static bool api_pipe_alter_context(struct pipes_struct *p,
 		goto err_exit;
 	}
 
-	if (pkt->u.bind.assoc_group_id != 0) {
-		assoc_gid = pkt->u.bind.assoc_group_id;
+	if (pkt->u.alter.assoc_group_id != 0) {
+		assoc_gid = pkt->u.alter.assoc_group_id;
 	} else {
 		assoc_gid = 0x53f0;
 	}
@@ -999,24 +999,24 @@ static bool api_pipe_alter_context(struct pipes_struct *p,
 	 */
 
 	/* If the requested abstract synt uuid doesn't match our client pipe,
-		reject the bind_ack & set the transfer interface synt to all 0's,
+		reject the alter_ack & set the transfer interface synt to all 0's,
 		ver 0 (observed when NT5 attempts to bind to abstract interfaces
 		unknown to NT4)
 		Needed when adding entries to a DACL from NT5 - SK */
 
 	if (check_bind_req(p,
-			&pkt->u.bind.ctx_list[0].abstract_syntax,
-			&pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
-			pkt->u.bind.ctx_list[0].context_id)) {
+			&pkt->u.alter.ctx_list[0].abstract_syntax,
+			&pkt->u.alter.ctx_list[0].transfer_syntaxes[0],
+			pkt->u.alter.ctx_list[0].context_id)) {
 
-		bind_ack_ctx.result = 0;
-		bind_ack_ctx.reason.value = 0;
-		bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
+		alter_ack_ctx.result = 0;
+		alter_ack_ctx.reason.value = 0;
+		alter_ack_ctx.syntax = pkt->u.alter.ctx_list[0].transfer_syntaxes[0];
 	} else {
 		/* Rejection reason: abstract syntax not supported */
-		bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
-		bind_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
-		bind_ack_ctx.syntax = ndr_syntax_id_null;
+		alter_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
+		alter_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
+		alter_ack_ctx.syntax = ndr_syntax_id_null;
 	}
 
 	/*
@@ -1031,7 +1031,7 @@ static bool api_pipe_alter_context(struct pipes_struct *p,
 		}
 
 		status = dcerpc_pull_auth_trailer(pkt, pkt,
-						  &pkt->u.bind.auth_info,
+						  &pkt->u.alter.auth_info,
 						  &auth_info, NULL, true);
 		if (!NT_STATUS_IS_OK(status)) {
 			DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
@@ -1088,7 +1088,7 @@ static bool api_pipe_alter_context(struct pipes_struct *p,
 	u.alter_resp.secondary_address_size = 1;
 
 	u.alter_resp.num_results = 1;
-	u.alter_resp.ctx_list = &bind_ack_ctx;
+	u.alter_resp.ctx_list = &alter_ack_ctx;
 
 	/* NOTE: We leave the auth_info empty so we can calculate the padding
 	 * later and then append the auth_info --simo */
@@ -1108,7 +1108,7 @@ static bool api_pipe_alter_context(struct pipes_struct *p,
 					  &u,
 					  &p->out_data.frag);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
+		DEBUG(0, ("Failed to marshall alter_resp packet. (%s)\n",
 			  nt_errstr(status)));
 		goto err_exit;
 	}