1 From 8e49de7754f7171a58a1f94dee0f1138dbee3c60 Mon Sep 17 00:00:00 2001
2 From: Jeremy Allison <jra@samba.org>
3 Date: Fri, 23 Oct 2015 14:54:31 -0700
4 Subject: [PATCH] CVE-2015-5299: s3-shadow-copy2: fix missing access check on
7 Fix originally from <partha@exablox.com>
9 https://bugzilla.samba.org/show_bug.cgi?id=11529
11 Signed-off-by: Jeremy Allison <jra@samba.org>
12 Reviewed-by: David Disseldorp <ddiss@samba.org>
14 source3/modules/vfs_shadow_copy2.c | 47 ++++++++++++++++++++++++++++++++++++++
15 1 file changed, 47 insertions(+)
17 --- a/source3/modules/vfs_shadow_copy2.c
18 +++ b/source3/modules/vfs_shadow_copy2.c
22 #include "smbd/smbd.h"
23 +#include "smbd/globals.h"
24 +#include "../libcli/security/security.h"
25 #include "system/filesys.h"
28 @@ -764,6 +766,43 @@ static int shadow_copy2_mkdir(vfs_handle
29 SHADOW2_NEXT(MKDIR, (handle, name, mode), int, -1);
32 +static bool check_access_snapdir(struct vfs_handle_struct *handle,
35 + struct smb_filename smb_fname;
38 + uint32_t access_granted = 0;
40 + ZERO_STRUCT(smb_fname);
41 + smb_fname.base_name = talloc_asprintf(talloc_tos(),
44 + if (smb_fname.base_name == NULL) {
48 + ret = SMB_VFS_NEXT_STAT(handle, &smb_fname);
49 + if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) {
50 + TALLOC_FREE(smb_fname.base_name);
54 + status = smbd_check_open_rights(handle->conn,
58 + if (!NT_STATUS_IS_OK(status)) {
59 + DEBUG(0,("user does not have list permission "
61 + smb_fname.base_name));
62 + TALLOC_FREE(smb_fname.base_name);
65 + TALLOC_FREE(smb_fname.base_name);
69 static int shadow_copy2_rmdir(vfs_handle_struct *handle, const char *fname)
71 SHADOW2_NEXT(RMDIR, (handle, name), int, -1);
72 @@ -877,6 +916,7 @@ static int shadow_copy2_get_shadow_copy2
74 TALLOC_CTX *tmp_ctx = talloc_new(handle->data);
78 snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle);
79 if (snapdir == NULL) {
80 @@ -886,6 +926,13 @@ static int shadow_copy2_get_shadow_copy2
84 + ret = check_access_snapdir(handle, snapdir);
86 + DEBUG(0,("access denied on listing snapdir %s\n", snapdir));
88 + talloc_free(tmp_ctx);
92 p = SMB_VFS_NEXT_OPENDIR(handle, snapdir, NULL, 0);