37 lines
1.0 KiB
Diff
37 lines
1.0 KiB
Diff
From 167f78aa97af6502cb2027dc9dad40399b0a9c4f Mon Sep 17 00:00:00 2001
|
|
From: Jeremy Allison <jra@samba.org>
|
|
Date: Tue, 6 Aug 2019 12:08:09 -0700
|
|
Subject: [PATCH 2/7] CVE-2019-10218 - s3: libsmb: Protect SMB2 client code
|
|
from evil server returned names.
|
|
|
|
Disconnect with NT_STATUS_INVALID_NETWORK_RESPONSE if so.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14071
|
|
|
|
Signed-off-by: Jeremy Allison <jra@samba.org>
|
|
---
|
|
source3/libsmb/cli_smb2_fnum.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/source3/libsmb/cli_smb2_fnum.c b/source3/libsmb/cli_smb2_fnum.c
|
|
index 1cfa50ffbac..3cdf68dc24b 100644
|
|
--- a/source3/libsmb/cli_smb2_fnum.c
|
|
+++ b/source3/libsmb/cli_smb2_fnum.c
|
|
@@ -1017,6 +1017,13 @@ NTSTATUS cli_smb2_list(struct cli_state *cli,
|
|
goto fail;
|
|
}
|
|
|
|
+ /* Protect against server attack. */
|
|
+ status = is_bad_finfo_name(cli, finfo);
|
|
+ if (!NT_STATUS_IS_OK(status)) {
|
|
+ smbXcli_conn_disconnect(cli->conn, status);
|
|
+ goto fail;
|
|
+ }
|
|
+
|
|
if (dir_check_ftype((uint32_t)finfo->mode,
|
|
(uint32_t)attribute)) {
|
|
/*
|
|
--
|
|
2.17.1
|
|
|