From 8e49de7754f7171a58a1f94dee0f1138dbee3c60 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Fri, 23 Oct 2015 14:54:31 -0700 Subject: [PATCH] CVE-2015-5299: s3-shadow-copy2: fix missing access check on snapdir Fix originally from https://bugzilla.samba.org/show_bug.cgi?id=11529 Signed-off-by: Jeremy Allison Reviewed-by: David Disseldorp --- source3/modules/vfs_shadow_copy2.c | 47 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) --- a/source3/modules/vfs_shadow_copy2.c +++ b/source3/modules/vfs_shadow_copy2.c @@ -21,6 +21,8 @@ #include "includes.h" #include "smbd/smbd.h" +#include "smbd/globals.h" +#include "../libcli/security/security.h" #include "system/filesys.h" #include "ntioctl.h" @@ -764,6 +766,43 @@ static int shadow_copy2_mkdir(vfs_handle SHADOW2_NEXT(MKDIR, (handle, name, mode), int, -1); } +static bool check_access_snapdir(struct vfs_handle_struct *handle, + const char *path) +{ + struct smb_filename smb_fname; + int ret; + NTSTATUS status; + uint32_t access_granted = 0; + + ZERO_STRUCT(smb_fname); + smb_fname.base_name = talloc_asprintf(talloc_tos(), + "%s", + path); + if (smb_fname.base_name == NULL) { + return false; + } + + ret = SMB_VFS_NEXT_STAT(handle, &smb_fname); + if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) { + TALLOC_FREE(smb_fname.base_name); + return false; + } + + status = smbd_check_open_rights(handle->conn, + &smb_fname, + SEC_DIR_LIST, + &access_granted); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(0,("user does not have list permission " + "on snapdir %s\n", + smb_fname.base_name)); + TALLOC_FREE(smb_fname.base_name); + return false; + } + TALLOC_FREE(smb_fname.base_name); + return true; +} + static int shadow_copy2_rmdir(vfs_handle_struct *handle, const char *fname) { SHADOW2_NEXT(RMDIR, (handle, name), int, -1); @@ -877,6 +916,7 @@ static int shadow_copy2_get_shadow_copy2 SMB_STRUCT_DIRENT *d; TALLOC_CTX *tmp_ctx = talloc_new(handle->data); char *snapshot; + bool ret; snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle); if (snapdir == NULL) { @@ -886,6 +926,13 @@ static int shadow_copy2_get_shadow_copy2 talloc_free(tmp_ctx); return -1; } + ret = check_access_snapdir(handle, snapdir); + if (!ret) { + DEBUG(0,("access denied on listing snapdir %s\n", snapdir)); + errno = EACCES; + talloc_free(tmp_ctx); + return -1; + } p = SMB_VFS_NEXT_OPENDIR(handle, snapdir, NULL, 0);