diff options
| author | Volker Lendecke <vl@samba.org> | 2017-05-08 21:40:40 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2017-05-19 10:24:25 +0200 |
| commit | 279f4afc4a869b24201465b9d18b9f2f9631d2cf (patch) | |
| tree | 2caefbc48d32f527ef83e08b0a2a7de650a010d0 | |
| parent | 59b2ef18cb19eb4ceed898e5a3f13e196582dd51 (diff) | |
| download | samba-279f4afc4a869b24201465b9d18b9f2f9631d2cf.tar.gz | |
CVE-2017-7494: rpc_server3: Refuse to open pipe names with / inside
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12780
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
| -rw-r--r-- | source3/rpc_server/srv_pipe.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index bcd7e5db6c2..40d60a76ed2 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -476,6 +476,11 @@ bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax) { NTSTATUS status; + if (strchr(pipename, '/')) { + DEBUG(1, ("Refusing open on pipe %s\n", pipename)); + return false; + } + if (lp_disable_spoolss() && strequal(pipename, "spoolss")) { DEBUG(10, ("refusing spoolss access\n")); return false; |