From 9e6620b22f3d20b4f05f38ea2a16c7f8ec6ea1b7 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Tue, 5 Jan 2016 10:52:50 -0800 Subject: CVE-2015-7560: s3: smbd: Refuse to set an ACL from a POSIX file handle on a symlink. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648 Signed-off-by: Jeremy Allison Reviewed-by: Michael Adam --- source3/smbd/nttrans.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c index 5a6a784b16d..8d887a30076 100644 --- a/source3/smbd/nttrans.c +++ b/source3/smbd/nttrans.c @@ -882,6 +882,12 @@ NTSTATUS set_sd(files_struct *fsp, struct security_descriptor *psd, return NT_STATUS_OK; } + if (S_ISLNK(fsp->fsp_name->st.st_ex_mode)) { + DEBUG(10, ("ACL set on symlink %s denied.\n", + fsp_str_dbg(fsp))); + return NT_STATUS_ACCESS_DENIED; + } + if (psd->owner_sid == NULL) { security_info_sent &= ~SECINFO_OWNER; } -- cgit v1.2.1