From 32cdad66bde9c385bd07cb373812bd9a46d0b86b Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Wed, 28 Jan 2015 14:47:31 -0800 Subject: [PATCH 1/3] CVE-2015-0240: s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer. Bug: https://bugzilla.samba.org/show_bug.cgi?id=11077 Signed-off-by: Jeremy Allison Reviewed-by: Stefan Metzmacher --- source3/rpc_server/netlogon/srv_netlog_nt.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c index 3fd93bc..0366caa 100644 --- a/source3/rpc_server/netlogon/srv_netlog_nt.c +++ b/source3/rpc_server/netlogon/srv_netlog_nt.c @@ -1070,6 +1070,10 @@ static NTSTATUS netr_creds_server_step_check(struct pipes_struct *p, NTSTATUS status; bool schannel_global_required = (lp_server_schannel() == true) ? true:false; + if (creds_out != NULL) { + *creds_out = NULL; + } + if (schannel_global_required) { status = schannel_check_required(&p->auth, computer_name, @@ -1205,7 +1209,7 @@ NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p, { NTSTATUS status = NT_STATUS_OK; int i; - struct netlogon_creds_CredentialState *creds; + struct netlogon_creds_CredentialState *creds = NULL; DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__)); -- 2.3.0 From 38225873da44350663d36cecc8d8d60aa5f0e54a Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 16 Feb 2015 10:59:23 +0100 Subject: [PATCH 2/3] s3-netlogon: Make sure we do not deference a NULL pointer. This is an additional patch for CVE-2015-0240. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077#c32 Pair-Programmed-With: Michael Adam Pair-Programmed-With: Andreas Schneider Signed-off-by: Michael Adam Signed-off-by: Andreas Schneider Reviewed-by: Volker Lendecke --- source3/rpc_server/netlogon/srv_netlog_nt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c index 0366caa..a26638e 100644 --- a/source3/rpc_server/netlogon/srv_netlog_nt.c +++ b/source3/rpc_server/netlogon/srv_netlog_nt.c @@ -1222,9 +1222,14 @@ NTSTATUS _netr_ServerPasswordSet(struct pipes_struct *p, unbecome_root(); if (!NT_STATUS_IS_OK(status)) { + const char *computer_name = ""; + + if (creds != NULL && creds->computer_name != NULL) { + computer_name = creds->computer_name; + } DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth " "request from client %s machine account %s\n", - r->in.computer_name, creds->computer_name)); + r->in.computer_name, computer_name)); TALLOC_FREE(creds); return status; } -- 2.3.0 From 6732025dd330ead77ee4ae44badbaa13044b6422 Mon Sep 17 00:00:00 2001 From: Andreas Schneider Date: Mon, 16 Feb 2015 10:56:03 +0100 Subject: [PATCH 3/3] auth: Make sure that creds_out is initialized with NULL. This is an additional patch for CVE-2015-0240. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11077#c32 Pair-Programmed-With: Michael Adam Pair-Programmed-With: Andreas Schneider Signed-off-by: Michael Adam Signed-off-by: Andreas Schneider Reviewed-by: Volker Lendecke --- libcli/auth/schannel_state_tdb.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libcli/auth/schannel_state_tdb.c b/libcli/auth/schannel_state_tdb.c index ca35a11..145005c 100644 --- a/libcli/auth/schannel_state_tdb.c +++ b/libcli/auth/schannel_state_tdb.c @@ -285,6 +285,10 @@ NTSTATUS schannel_check_creds_state(TALLOC_CTX *mem_ctx, NTSTATUS status; int ret; + if (creds_out != NULL) { + *creds_out = NULL; + } + tmpctx = talloc_named(mem_ctx, 0, "schannel_check_creds_state"); if (!tmpctx) { return NT_STATUS_NO_MEMORY; -- 2.3.0