|
 |
6539dc |
From 3f8b6a3c56ec188d662767027703999faf14e71f Mon Sep 17 00:00:00 2001
|
|
|
5d669d |
From: Stefan Metzmacher <metze@samba.org>
|
|
|
5d669d |
Date: Wed, 20 Apr 2016 11:26:57 +0200
|
|
|
5d669d |
Subject: [PATCH 1/3] CVE-2016-2019: libcli/smb: don't allow guest sessions if
|
|
|
5d669d |
we require signing
|
|
|
5d669d |
|
|
|
5d669d |
Note real anonymous sessions (with "" as username) don't hit this
|
|
|
5d669d |
as we don't even call smb2cli_session_set_session_key() in that case.
|
|
|
5d669d |
|
|
|
5d669d |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860
|
|
|
5d669d |
|
|
|
5d669d |
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
|
5d669d |
---
|
|
|
5d669d |
libcli/smb/smbXcli_base.c | 19 +++++++++++++++++--
|
|
|
5d669d |
1 file changed, 17 insertions(+), 2 deletions(-)
|
|
|
5d669d |
|
|
|
5d669d |
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
|
|
|
6539dc |
index 4332374..691b8ff 100644
|
|
|
5d669d |
--- a/libcli/smb/smbXcli_base.c
|
|
|
5d669d |
+++ b/libcli/smb/smbXcli_base.c
|
|
|
6539dc |
@@ -5312,6 +5312,10 @@ bool smbXcli_session_is_guest(struct smbXcli_session *session)
|
|
|
5d669d |
return false;
|
|
|
5d669d |
}
|
|
|
5d669d |
|
|
|
5d669d |
+ if (session->conn->mandatory_signing) {
|
|
|
5d669d |
+ return false;
|
|
|
5d669d |
+ }
|
|
|
5d669d |
+
|
|
|
5d669d |
if (session->conn->protocol >= PROTOCOL_SMB2_02) {
|
|
|
5d669d |
if (session->smb2->session_flags & SMB2_SESSION_FLAG_IS_GUEST) {
|
|
|
5d669d |
return true;
|
|
|
6539dc |
@@ -5571,7 +5575,7 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
|
|
|
5d669d |
const struct iovec *recv_iov)
|
|
|
5d669d |
{
|
|
|
5d669d |
struct smbXcli_conn *conn = session->conn;
|
|
|
5d669d |
- uint16_t no_sign_flags;
|
|
|
5d669d |
+ uint16_t no_sign_flags = 0;
|
|
|
5d669d |
uint8_t session_key[16];
|
|
|
5d669d |
bool check_signature = true;
|
|
|
5d669d |
uint32_t hdr_flags;
|
|
|
6539dc |
@@ -5596,7 +5600,18 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
|
|
|
5d669d |
return NT_STATUS_INVALID_PARAMETER_MIX;
|
|
|
5d669d |
}
|
|
|
5d669d |
|
|
|
5d669d |
- no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST | SMB2_SESSION_FLAG_IS_NULL;
|
|
|
5d669d |
+ if (!conn->mandatory_signing) {
|
|
|
5d669d |
+ /*
|
|
|
5d669d |
+ * only allow guest sessions without
|
|
|
5d669d |
+ * mandatory signing.
|
|
|
5d669d |
+ *
|
|
|
5d669d |
+ * If we try an authentication with username != ""
|
|
|
5d669d |
+ * and the server let us in without verifying the
|
|
|
5d669d |
+ * password we don't have a negotiated session key
|
|
|
5d669d |
+ * for signing.
|
|
|
5d669d |
+ */
|
|
|
5d669d |
+ no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST;
|
|
|
5d669d |
+ }
|
|
|
5d669d |
|
|
|
5d669d |
if (session->smb2->session_flags & no_sign_flags) {
|
|
|
5d669d |
session->smb2->should_sign = false;
|
|
|
5d669d |
--
|
|
|
5d669d |
1.9.1
|
|
|
5d669d |
|
|
|
5d669d |
|
|
|
6539dc |
From 11db8ea97ddb3cf9fde48dbe5df14a71ebc308db Mon Sep 17 00:00:00 2001
|
|
|
5d669d |
From: Stefan Metzmacher <metze@samba.org>
|
|
|
5d669d |
Date: Thu, 28 Apr 2016 02:36:35 +0200
|
|
|
5d669d |
Subject: [PATCH 2/3] CVE-2016-2019: s3:libsmb: add comment regarding
|
|
|
5d669d |
smbXcli_session_is_guest() with mandatory signing
|
|
|
5d669d |
|
|
|
5d669d |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860
|
|
|
5d669d |
|
|
|
5d669d |
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
|
5d669d |
---
|
|
|
5d669d |
source3/libsmb/cliconnect.c | 3 +++
|
|
|
5d669d |
1 file changed, 3 insertions(+)
|
|
|
5d669d |
|
|
|
5d669d |
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
|
|
|
6539dc |
index ea92c8f..ebba8f2 100644
|
|
|
5d669d |
--- a/source3/libsmb/cliconnect.c
|
|
|
5d669d |
+++ b/source3/libsmb/cliconnect.c
|
|
|
6539dc |
@@ -1588,6 +1588,9 @@ static void cli_session_setup_gensec_remote_done(struct tevent_req *subreq)
|
|
|
5d669d |
* have a negotiated session key.
|
|
|
5d669d |
*
|
|
|
5d669d |
* So just pretend we are completely done.
|
|
|
5d669d |
+ *
|
|
|
5d669d |
+ * Note that smbXcli_session_is_guest()
|
|
|
5d669d |
+ * always returns false if we require signing.
|
|
|
5d669d |
*/
|
|
|
5d669d |
state->blob_in = data_blob_null;
|
|
|
5d669d |
state->local_ready = true;
|
|
|
5d669d |
--
|
|
|
5d669d |
1.9.1
|
|
|
5d669d |
|
|
|
5d669d |
|
|
|
6539dc |
From 28ed026b9486fb248daf713655ea307c478d2832 Mon Sep 17 00:00:00 2001
|
|
|
5d669d |
From: Stefan Metzmacher <metze@samba.org>
|
|
|
5d669d |
Date: Thu, 28 Apr 2016 02:24:52 +0200
|
|
|
5d669d |
Subject: [PATCH 3/3] CVE-2016-2019: s3:selftest: add regression tests for
|
|
|
5d669d |
guest logins and mandatory signing
|
|
|
5d669d |
|
|
|
5d669d |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11860
|
|
|
5d669d |
|
|
|
5d669d |
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
|
5d669d |
---
|
|
|
5d669d |
source3/script/tests/test_smbclient_ntlm.sh | 4 ++++
|
|
|
5d669d |
1 file changed, 4 insertions(+)
|
|
|
5d669d |
|
|
|
5d669d |
diff --git a/source3/script/tests/test_smbclient_ntlm.sh b/source3/script/tests/test_smbclient_ntlm.sh
|
|
|
5d669d |
index b8fc564..33a927f 100755
|
|
|
5d669d |
--- a/source3/script/tests/test_smbclient_ntlm.sh
|
|
|
5d669d |
+++ b/source3/script/tests/test_smbclient_ntlm.sh
|
|
|
5d669d |
@@ -37,4 +37,8 @@ else
|
|
|
5d669d |
|
|
|
5d669d |
testit "smbclient baduser.badpassword.NT1NEW.guest" $SMBCLIENT //$SERVER/IPC\$ $CONFIGURATION -Ubaduser%badpassword -mNT1 -c quit $ADDARGS
|
|
|
5d669d |
testit "smbclient baduser.badpassword.SMB3.guest" $SMBCLIENT //$SERVER/IPC\$ $CONFIGURATION -Ubaduser%badpassword -mSMB3 -c quit $ADDARGS
|
|
|
5d669d |
+
|
|
|
5d669d |
+ testit_expect_failure "smbclient baduser.badpassword.NT1OLD.signfail" $SMBCLIENT //$SERVER/IPC\$ $CONFIGURATION -Ubaduser%badpassword -mNT1 --option=clientusespnego=no --option=clientntlmv2auth=no --signing=required -c quit $ADDARGS
|
|
|
5d669d |
+ testit_expect_failure "smbclient baduser.badpassword.NT1NEW.signfail" $SMBCLIENT //$SERVER/IPC\$ $CONFIGURATION -Ubaduser%badpassword -mNT1 --signing=required -c quit $ADDARGS
|
|
|
5d669d |
+ testit_expect_failure "smbclient baduser.badpassword.SMB3.signfail" $SMBCLIENT //$SERVER/IPC\$ $CONFIGURATION -Ubaduser%badpassword -mSMB3 --signing=required -c quit $ADDARGS
|
|
|
5d669d |
fi
|
|
|
5d669d |
--
|
|
|
5d669d |
1.9.1
|
|
|
5d669d |
|