commit 706384a4f63961ee3ccd2125c25453de43f7257a Author: Gerald (Jerry) Carter Date: Wed Nov 14 20:54:44 2007 -0600 Fix for CVE-2007-4572 == Subject: Stack buffer overflow in nmbd's logon == request processing. == == CVE ID#: CVE-2007-4572 == == Versions: Samba 3.0.0 - 3.0.26a (inclusive) ... Samba developers have discovered what is believed to be a non-exploitable buffer over in nmbd during the processing of GETDC logon server requests. This code is only used when the Samba server is configured as a Primary or Backup Domain Controller. diff --git a/source/lib/charcnv.c b/source/lib/charcnv.c index 8d5fbc8..2341429 100644 --- a/source/lib/charcnv.c +++ b/source/lib/charcnv.c @@ -872,9 +872,9 @@ size_t push_ascii(void *dest, const char *src, size_t dest_len, int flags) size_t src_len = strlen(src); pstring tmpbuf; - /* treat a pstring as "unlimited" length */ + /* No longer allow a length of -1 */ if (dest_len == (size_t)-1) - dest_len = sizeof(pstring); + smb_panic("push_ascii - dest_len == -1"); if (flags & STR_UPPER) { pstrcpy(tmpbuf, src); diff --git a/source/libsmb/ntlmssp_parse.c b/source/libsmb/ntlmssp_parse.c index e715048..38a65d3 100644 --- a/source/libsmb/ntlmssp_parse.c +++ b/source/libsmb/ntlmssp_parse.c @@ -152,7 +152,8 @@ BOOL msrpc_gen(DATA_BLOB *blob, break; case 'C': s = va_arg(ap, char *); - head_ofs += push_string(NULL, blob->data+head_ofs, s, -1, + n = str_charnum(s) + 1; + head_ofs += push_string(NULL, blob->data+head_ofs, s, n, STR_ASCII|STR_TERMINATE); break; } diff --git a/source/nmbd/nmbd_processlogon.c b/source/nmbd/nmbd_processlogon.c index 1672b03..05e82a4 100644 --- a/source/nmbd/nmbd_processlogon.c +++ b/source/nmbd/nmbd_processlogon.c @@ -135,7 +135,9 @@ logons are not enabled.\n", inet_ntoa(p->ip) )); fstrcpy(reply_name, "\\\\"); fstrcat(reply_name, my_name); - push_ascii_fstring(q, reply_name); + push_ascii(q,reply_name, + sizeof(outbuf)-PTR_DIFF(q, outbuf), + STR_TERMINATE); q = skip_string(outbuf,sizeof(outbuf),q); /* PDC name */ SSVAL(q, 0, token); @@ -231,7 +233,9 @@ logons are not enabled.\n", inet_ntoa(p->ip) )); q += 2; fstrcpy(reply_name,my_name); - push_ascii_fstring(q, reply_name); + push_ascii(q, reply_name, + sizeof(outbuf)-PTR_DIFF(q, outbuf), + STR_TERMINATE); q = skip_string(outbuf,sizeof(outbuf),q); /* PDC name */ /* PDC and domain name */ @@ -239,8 +243,15 @@ logons are not enabled.\n", inet_ntoa(p->ip) )); /* Make a full reply */ q = ALIGN2(q, outbuf); - q += dos_PutUniCode(q, my_name, sizeof(pstring), True); /* PDC name */ - q += dos_PutUniCode(q, lp_workgroup(),sizeof(pstring), True); /* Domain name*/ + q += dos_PutUniCode(q, my_name, + sizeof(outbuf) - PTR_DIFF(q, outbuf), + True); /* PDC name */ + q += dos_PutUniCode(q, lp_workgroup(), + sizeof(outbuf) - PTR_DIFF(q, outbuf), + True); /* Domain name*/ + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 8) { + return; + } SIVAL(q, 0, 1); /* our nt version */ SSVAL(q, 4, 0xffff); /* our lmnttoken */ SSVAL(q, 6, 0xffff); /* our lm20token */ @@ -376,9 +387,15 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", q += 2; - q += dos_PutUniCode(q, reply_name,sizeof(pstring), True); - q += dos_PutUniCode(q, ascuser, sizeof(pstring), True); - q += dos_PutUniCode(q, lp_workgroup(),sizeof(pstring), True); + q += dos_PutUniCode(q, reply_name, + sizeof(outbuf) - PTR_DIFF(q, outbuf), + True); + q += dos_PutUniCode(q, ascuser, + sizeof(outbuf) - PTR_DIFF(q, outbuf), + True); + q += dos_PutUniCode(q, lp_workgroup(), + sizeof(outbuf) - PTR_DIFF(q, outbuf), + True); } #ifdef HAVE_ADS else { @@ -394,6 +411,9 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", get_mydnsdomname(domain); get_myname(hostname); + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 8) { + return; + } if (SVAL(uniuser, 0) == 0) { SIVAL(q, 0, SAMLOGON_AD_UNK_R); /* user unknown */ } else { @@ -406,6 +426,9 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", q += 4; /* Push Domain GUID */ + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < UUID_FLAT_SIZE) { + return; + } if (False == secrets_fetch_domain_guid(domain, &domain_guid)) { DEBUG(2, ("Could not fetch DomainGUID for %s\n", domain)); return; @@ -421,12 +444,20 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", q1 = q; while ((component = strtok(dc, "."))) { dc = NULL; - size = push_ascii(&q[1], component, -1, 0); + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 1) { + return; + } + size = push_ascii(&q[1], component, + sizeof(outbuf) - PTR_DIFF(q+1, outbuf), + 0); SCVAL(q, 0, size); q += (size + 1); } /* Unk0 */ + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 4) { + return; + } SCVAL(q, 0, 0); q++; @@ -436,44 +467,72 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", q += 2; /* Hostname */ - size = push_ascii(&q[1], hostname, -1, 0); + size = push_ascii(&q[1], hostname, + sizeof(outbuf) - PTR_DIFF(q+1, outbuf), + 0); SCVAL(q, 0, size); q += (size + 1); + + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 3) { + return; + } + SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); SCVAL(q, 1, str_offset & 0xFF); q += 2; /* NETBIOS of domain */ - size = push_ascii(&q[1], lp_workgroup(), -1, STR_UPPER); + size = push_ascii(&q[1], lp_workgroup(), + sizeof(outbuf) - PTR_DIFF(q+1, outbuf), + STR_UPPER); SCVAL(q, 0, size); q += (size + 1); /* Unk1 */ + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 2) { + return; + } SCVAL(q, 0, 0); q++; /* NETBIOS of hostname */ - size = push_ascii(&q[1], my_name, -1, 0); + size = push_ascii(&q[1], my_name, + sizeof(outbuf) - PTR_DIFF(q+1, outbuf), + 0); SCVAL(q, 0, size); q += (size + 1); /* Unk2 */ + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 4) { + return; + } SCVAL(q, 0, 0); q++; /* User name */ if (SVAL(uniuser, 0) != 0) { - size = push_ascii(&q[1], ascuser, -1, 0); + size = push_ascii(&q[1], ascuser, + sizeof(outbuf) - PTR_DIFF(q+1, outbuf), + 0); SCVAL(q, 0, size); q += (size + 1); } q_orig = q; /* Site name */ - size = push_ascii(&q[1], "Default-First-Site-Name", -1, 0); + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 1) { + return; + } + size = push_ascii(&q[1], "Default-First-Site-Name", + sizeof(outbuf) - PTR_DIFF(q+1, outbuf), + 0); SCVAL(q, 0, size); q += (size + 1); + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 18) { + return; + } + /* Site name (2) */ str_offset = q - q_orig; SCVAL(q, 0, 0xc0 | ((str_offset >> 8) & 0x3F)); @@ -494,6 +553,10 @@ reporting %s domain %s 0x%x ntversion=%x lm_nt token=%x lm_20 token=%x\n", } #endif + if (sizeof(outbuf) - PTR_DIFF(q, outbuf) < 8) { + return; + } + /* tell the client what version we are */ SIVAL(q, 0, ((ntversion < 11) || (SEC_ADS != lp_security())) ? 1 : 13); /* our ntversion */ diff --git a/source/smbd/lanman.c b/source/smbd/lanman.c index ff2044b..000b2f4 100644 --- a/source/smbd/lanman.c +++ b/source/smbd/lanman.c @@ -404,7 +404,7 @@ static void PackDriverData(struct pack_desc* desc) SIVAL(drivdata,0,sizeof drivdata); /* cb */ SIVAL(drivdata,4,1000); /* lVersion */ memset(drivdata+8,0,32); /* szDeviceName */ - push_ascii(drivdata+8,"NULL",-1, STR_TERMINATE); + push_ascii(drivdata+8,"NULL",32, STR_TERMINATE); PACKl(desc,"l",drivdata,sizeof drivdata); /* pDriverData */ }