[SCM] Samba Shared Repository - branch v3-3-stable updated
Karolin Seeger
kseeger at samba.org
Tue Jul 26 11:26:30 MDT 2011
The branch, v3-3-stable has been updated
via f571f36 s3-swat: Fix typo.
via 3973cfa s3 swat: Create random nonce in CGI mode
via 11e2812 s3 swat: Add time component to XSRF token
via 407ae61 s3 swat: Add XSRF protection to printer page
via 4850456 s3 swat: Add XSRF protection to password page
via ef457a2 s3 swat: Add XSRF protection to shares page
via 8fb3064 s3 swat: Add XSRF protection to globals page
via eb22fd7 s3 swat: Add XSRF protection to wizard page
via 94f8482 s3 swat: Add XSRF protection to wizard_params page
via ba996f0 s3 swat: Add XSRF protection to viewconfig page
via 3f38cf4 s3 swat: Add XSRF protection to status page
via 3806fec s3 swat: Add support for anti-XSRF token
via b610e0c s3 swat: Allow getting the user's HTTP auth password
via d401cca s3 swat: Fix possible XSS attack (bug #8289)
via 5d2d4fb WAHTSNEW: Prepare release notes for 3.3.16.
via ad64256 VERSION: Bump version number up to 3.3.16.
from 074ad65 WHATSNEW: Prepare 3.3.15 release notes.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-3-stable
- Log -----------------------------------------------------------------
commit f571f362deaa5bfbdb22c3a7d8409bab9b6c8d82
Author: Karolin Seeger <kseeger at samba.org>
Date: Sun Jul 24 21:09:38 2011 +0200
s3-swat: Fix typo.
Thanks to Simo for reporting!
Karolin
commit 3973cfa50024983618a44ffdb9f756b642b85be7
Author: Kai Blin <kai at samba.org>
Date: Tue Jul 12 08:08:24 2011 +0200
s3 swat: Create random nonce in CGI mode
In CGI mode, we don't get access to the user's password, which would
reduce the hash used so far to parameters an attacker can easily guess.
To work around this, read the nonce from secrets.tdb or generate one if
it's not there.
Also populate the C_user field so we can use that for token creation.
Signed-off-by: Kai Blin <kai at samba.org>
The last 12 patches address bug #8290 (CSRF vulnerability in SWAT).
This addresses CVE-2011-2522 (Cross-Site Request Forgery in SWAT).
commit 11e281228f334bf3d384df5655136f0b4b4068aa
Author: Kai Blin <kai at samba.org>
Date: Sat Jul 9 09:52:07 2011 +0200
s3 swat: Add time component to XSRF token
Signed-off-by: Kai Blin <kai at samba.org>
commit 407ae61fbfc8ee1643a4db8ea9b104f031b32e0f
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 15:06:13 2011 +0200
s3 swat: Add XSRF protection to printer page
Signed-off-by: Kai Blin <kai at samba.org>
commit 4850456845d2da5e3451716a5ad4ca0ef034e01f
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 15:05:38 2011 +0200
s3 swat: Add XSRF protection to password page
Signed-off-by: Kai Blin <kai at samba.org>
commit ef457a20422cfa8231e25b539d2cd87f299686b9
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 15:04:48 2011 +0200
s3 swat: Add XSRF protection to shares page
Signed-off-by: Kai Blin <kai at samba.org>
commit 8fb3064eeaa3640af6c8b91aa5859d8bfb6d0888
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 15:04:12 2011 +0200
s3 swat: Add XSRF protection to globals page
Signed-off-by: Kai Blin <kai at samba.org>
commit eb22fd73060534700d514ec295985549131c7569
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 15:03:44 2011 +0200
s3 swat: Add XSRF protection to wizard page
Signed-off-by: Kai Blin <kai at samba.org>
commit 94f8482607a175c44436fae456fbda3624629982
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 15:03:15 2011 +0200
s3 swat: Add XSRF protection to wizard_params page
Signed-off-by: Kai Blin <kai at samba.org>
commit ba996f0ae87f6bf4f19a4918e44dbd6d44a96561
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 15:02:53 2011 +0200
s3 swat: Add XSRF protection to viewconfig page
Signed-off-by: Kai Blin <kai at samba.org>
commit 3f38cf42facc38c19e0448cbae3078b9606b08e4
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 12:58:53 2011 +0200
s3 swat: Add XSRF protection to status page
Signed-off-by: Kai Blin <kai at samba.org>
commit 3806fec53dcf3b6e5c3fd71917f9d67d47c65e32
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 12:57:43 2011 +0200
s3 swat: Add support for anti-XSRF token
Signed-off-by: Kai Blin <kai at samba.org>
commit b610e0cee563465c6b970647b215f8ae4d0c6599
Author: Kai Blin <kai at samba.org>
Date: Fri Jul 8 12:56:21 2011 +0200
s3 swat: Allow getting the user's HTTP auth password
Signed-off-by: Kai Blin <kai at samba.org>
commit d401ccaedaec09ad6900ec24ecaf205bed3e3ac1
Author: Kai Blin <kai at samba.org>
Date: Thu Jul 7 10:03:33 2011 +0200
s3 swat: Fix possible XSS attack (bug #8289)
Nobuhiro Tsuji of NTT DATA SECURITY CORPORATION reported a possible XSS attack
against SWAT, the Samba Web Administration Tool. The attack uses reflection to
insert arbitrary content into the "change password" page.
This patch fixes the reflection issue by not printing user-specified content on
the website anymore.
Signed-off-by: Kai Blin <kai at samba.org>
CVE-2011-2694.
commit 5d2d4fbf5bcf6aa1c1d994adaed22dec3ba09b9c
Author: Karolin Seeger <kseeger at samba.org>
Date: Sun Jul 24 20:36:30 2011 +0200
WAHTSNEW: Prepare release notes for 3.3.16.
Karolin
commit ad64256e19bef0b4441bc660faf524150e12bdf8
Author: Karolin Seeger <kseeger at samba.org>
Date: Sun Jul 24 20:25:08 2011 +0200
VERSION: Bump version number up to 3.3.16.
Karolin
-----------------------------------------------------------------------
Summary of changes:
WHATSNEW.txt | 62 ++++++++++++++++-
source/VERSION | 2 +-
source/web/cgi.c | 27 +++++++-
source/web/statuspage.c | 7 ++
source/web/swat.c | 174 ++++++++++++++++++++++++++++++++++++++--------
source/web/swat_proto.h | 6 ++
6 files changed, 243 insertions(+), 35 deletions(-)
Changeset truncated at 500 lines:
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 08a606b..140f22a 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,62 @@
==============================
+ Release Notes for Samba 3.3.16
+ July 26, 2011
+ ==============================
+
+
+This is a security release in order to address
+CVE-2011-2522 (Cross-Site Request Forgery in SWAT) and
+CVE-2011-2694 (Cross-Site Scripting vulnerability in SWAT).
+
+
+o CVE-2011-2522:
+ The Samba Web Administration Tool (SWAT) in Samba versions
+ 3.0.x to 3.5.9 are affected by a cross-site request forgery.
+
+
+o CVE-2011-2694:
+ The Samba Web Administration Tool (SWAT) in Samba versions
+ 3.0.x to 3.5.9 are affected by a cross-site scripting
+ vulnerability.
+
+Please note that SWAT must be enabled in order for these
+vulnerabilities to be exploitable. By default, SWAT
+is *not* enabled on a Samba install.
+
+
+Changes since 3.3.15
+--------------------
+
+
+o Kai Blin <kai at samba.org>
+ * BUG 8289: SWAT contains a cross-site scripting vulnerability.
+ * BUG 8290: CSRF vulnerability in SWAT.
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 3.3 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
+ ==============================
Release Notes for Samba 3.3.15
February 28, 2011
==============================
@@ -44,8 +102,8 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
==============================
Release Notes for Samba 3.3.14
diff --git a/source/VERSION b/source/VERSION
index 6e41021..29371ae 100644
--- a/source/VERSION
+++ b/source/VERSION
@@ -25,7 +25,7 @@
########################################################
SAMBA_VERSION_MAJOR=3
SAMBA_VERSION_MINOR=3
-SAMBA_VERSION_RELEASE=15
+SAMBA_VERSION_RELEASE=16
########################################################
# Bug fix releases use a letter for the patch revision #
diff --git a/source/web/cgi.c b/source/web/cgi.c
index 72aa11c..890ac8e 100644
--- a/source/web/cgi.c
+++ b/source/web/cgi.c
@@ -19,6 +19,7 @@
#include "includes.h"
#include "web/swat_proto.h"
+#include "secrets.h"
#define MAX_VARIABLES 10000
@@ -42,6 +43,7 @@ static char *query_string;
static const char *baseurl;
static char *pathinfo;
static char *C_user;
+static char *C_pass;
static bool inetd_server;
static bool got_request;
@@ -320,7 +322,22 @@ static void cgi_web_auth(void)
exit(0);
}
- setuid(0);
+ C_user = SMB_STRDUP(user);
+
+ if (!setuid(0)) {
+ C_pass = secrets_fetch_generic("root", "SWAT");
+ if (C_pass == NULL) {
+ char *tmp_pass = NULL;
+ tmp_pass = generate_random_str(16);
+ if (tmp_pass == NULL) {
+ printf("%sFailed to create random nonce for "
+ "SWAT session\n<br>%s\n", head, tail);
+ exit(0);
+ }
+ secrets_store_generic("root", "SWAT", tmp_pass);
+ C_pass = SMB_STRDUP(tmp_pass);
+ }
+ }
setuid(pwd->pw_uid);
if (geteuid() != pwd->pw_uid || getuid() != pwd->pw_uid) {
printf("%sFailed to become user %s - uid=%d/%d<br>%s\n",
@@ -388,6 +405,7 @@ static bool cgi_handle_authorization(char *line)
/* Save the users name */
C_user = SMB_STRDUP(user);
+ C_pass = SMB_STRDUP(user_pass);
TALLOC_FREE(pass);
return True;
}
@@ -422,6 +440,13 @@ char *cgi_user_name(void)
return(C_user);
}
+/***************************************************************************
+return a ptr to the users password
+ ***************************************************************************/
+char *cgi_user_pass(void)
+{
+ return(C_pass);
+}
/***************************************************************************
handle a file download
diff --git a/source/web/statuspage.c b/source/web/statuspage.c
index 8070ae7..fe545e4 100644
--- a/source/web/statuspage.c
+++ b/source/web/statuspage.c
@@ -247,9 +247,14 @@ void status_page(void)
int nr_running=0;
bool waitup = False;
TALLOC_CTX *ctx = talloc_stackframe();
+ const char form_name[] = "status";
smbd_pid = pid_to_procid(pidfile_pid("smbd"));
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
+
if (cgi_variable("smbd_restart") || cgi_variable("all_restart")) {
stop_smbd();
start_smbd();
@@ -326,9 +331,11 @@ void status_page(void)
initPid2Machine ();
+output_page:
printf("<H2>%s</H2>\n", _("Server Status"));
printf("<FORM method=post>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
if (!autorefresh) {
printf("<input type=submit value=\"%s\" name=\"autorefresh\">\n", _("Auto Refresh"));
diff --git a/source/web/swat.c b/source/web/swat.c
index 9c7294a..f21bcaa 100644
--- a/source/web/swat.c
+++ b/source/web/swat.c
@@ -50,6 +50,9 @@ static int iNumNonAutoPrintServices = 0;
#define DISABLE_USER_FLAG "disable_user_flag"
#define ENABLE_USER_FLAG "enable_user_flag"
#define RHOST "remote_host"
+#define XSRF_TOKEN "xsrf"
+#define XSRF_TIME "xsrf_time"
+#define XSRF_TIMEOUT 300
#define _(x) lang_msg_rotate(talloc_tos(),x)
@@ -138,6 +141,76 @@ static char *make_parm_name(const char *label)
return parmname;
}
+void get_xsrf_token(const char *username, const char *pass,
+ const char *formname, time_t xsrf_time, char token_str[33])
+{
+ struct MD5Context md5_ctx;
+ uint8_t token[16];
+ int i;
+
+ token_str[0] = '\0';
+ ZERO_STRUCT(md5_ctx);
+ MD5Init(&md5_ctx);
+
+ MD5Update(&md5_ctx, (uint8_t *)formname, strlen(formname));
+ MD5Update(&md5_ctx, (uint8_t *)&xsrf_time, sizeof(time_t));
+ if (username != NULL) {
+ MD5Update(&md5_ctx, (uint8_t *)username, strlen(username));
+ }
+ if (pass != NULL) {
+ MD5Update(&md5_ctx, (uint8_t *)pass, strlen(pass));
+ }
+
+ MD5Final(token, &md5_ctx);
+
+ for(i = 0; i < sizeof(token); i++) {
+ char tmp[3];
+
+ snprintf(tmp, sizeof(tmp), "%02x", token[i]);
+ strncat(token_str, tmp, sizeof(tmp));
+ }
+}
+
+void print_xsrf_token(const char *username, const char *pass,
+ const char *formname)
+{
+ char token[33];
+ time_t xsrf_time = time(NULL);
+
+ get_xsrf_token(username, pass, formname, xsrf_time, token);
+ printf("<input type=\"hidden\" name=\"%s\" value=\"%s\">\n",
+ XSRF_TOKEN, token);
+ printf("<input type=\"hidden\" name=\"%s\" value=\"%lld\">\n",
+ XSRF_TIME, (long long int)xsrf_time);
+}
+
+bool verify_xsrf_token(const char *formname)
+{
+ char expected[33];
+ const char *username = cgi_user_name();
+ const char *pass = cgi_user_pass();
+ const char *token = cgi_variable_nonull(XSRF_TOKEN);
+ const char *time_str = cgi_variable_nonull(XSRF_TIME);
+ time_t xsrf_time = 0;
+ time_t now = time(NULL);
+
+ if (sizeof(time_t) == sizeof(int)) {
+ xsrf_time = atoi(time_str);
+ } else if (sizeof(time_t) == sizeof(long)) {
+ xsrf_time = atol(time_str);
+ } else if (sizeof(time_t) == sizeof(long long)) {
+ xsrf_time = atoll(time_str);
+ }
+
+ if (abs(now - xsrf_time) > XSRF_TIMEOUT) {
+ return false;
+ }
+
+ get_xsrf_token(username, pass, formname, xsrf_time, expected);
+ return (strncmp(expected, token, sizeof(expected)) == 0);
+}
+
+
/****************************************************************************
include a lump of html in a page
****************************************************************************/
@@ -610,13 +683,20 @@ static void welcome_page(void)
static void viewconfig_page(void)
{
int full_view=0;
+ const char form_name[] = "viewconfig";
+
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
if (cgi_variable("full_view")) {
full_view = 1;
}
+output_page:
printf("<H2>%s</H2>\n", _("Current Config"));
printf("<form method=post>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
if (full_view) {
printf("<input type=submit name=\"normal_view\" value=\"%s\">\n", _("Normal View"));
@@ -636,18 +716,25 @@ static void viewconfig_page(void)
static void wizard_params_page(void)
{
unsigned int parm_filter = FLAG_WIZARD;
+ const char form_name[] = "wizard_params";
/* Here we first set and commit all the parameters that were selected
in the previous screen. */
printf("<H2>%s</H2>\n", _("Wizard Parameter Edit Page"));
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
+
if (cgi_variable("Commit")) {
commit_parameters(GLOBAL_SECTION_SNUM);
save_reload(0);
}
+output_page:
printf("<form name=\"swatform\" method=post action=wizard_params>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
if (have_write_access) {
printf("<input type=submit name=\"Commit\" value=\"Commit Changes\">\n");
@@ -683,6 +770,11 @@ static void wizard_page(void)
int have_home = -1;
int HomeExpo = 0;
int SerType = 0;
+ const char form_name[] = "wizard";
+
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
if (cgi_variable("Rewrite")) {
(void) rewritecfg_file();
@@ -773,10 +865,12 @@ static void wizard_page(void)
winstype = 3;
role = lp_server_role();
-
+
+output_page:
/* Here we go ... */
printf("<H2>%s</H2>\n", _("Samba Configuration Wizard"));
printf("<form method=post action=wizard>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
if (have_write_access) {
printf("%s\n", _("The \"Rewrite smb.conf file\" button will clear the smb.conf file of all default values and of comments."));
@@ -845,9 +939,14 @@ static void globals_page(void)
{
unsigned int parm_filter = FLAG_BASIC;
int mode = 0;
+ const char form_name[] = "globals";
printf("<H2>%s</H2>\n", _("Global Parameters"));
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
+
if (cgi_variable("Commit")) {
commit_parameters(GLOBAL_SECTION_SNUM);
save_reload(0);
@@ -860,7 +959,9 @@ static void globals_page(void)
if ( cgi_variable("AdvMode"))
mode = 1;
+output_page:
printf("<form name=\"swatform\" method=post action=globals>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
ViewModeBoxes( mode );
switch ( mode ) {
@@ -900,11 +1001,17 @@ static void shares_page(void)
int mode = 0;
unsigned int parm_filter = FLAG_BASIC;
size_t converted_size;
+ const char form_name[] = "shares";
+
+ printf("<H2>%s</H2>\n", _("Share Parameters"));
+
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
if (share)
snum = lp_servicenumber(share);
- printf("<H2>%s</H2>\n", _("Share Parameters"));
if (cgi_variable("Commit") && snum >= 0) {
commit_parameters(snum);
@@ -930,10 +1037,6 @@ static void shares_page(void)
}
}
- printf("<FORM name=\"swatform\" method=post>\n");
-
- printf("<table>\n");
-
if ( cgi_variable("ViewMode") )
mode = atoi(cgi_variable_nonull("ViewMode"));
if ( cgi_variable("BasicMode"))
@@ -941,6 +1044,12 @@ static void shares_page(void)
if ( cgi_variable("AdvMode"))
mode = 1;
+output_page:
+ printf("<FORM name=\"swatform\" method=post>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
+
+ printf("<table>\n");
+
ViewModeBoxes( mode );
switch ( mode ) {
case 0:
@@ -1120,11 +1229,9 @@ static void chg_passwd(void)
if(cgi_variable(CHG_S_PASSWD_FLAG)) {
printf("<p>");
if (rslt == True) {
- printf(_(" The passwd for '%s' has been changed."), cgi_variable_nonull(SWAT_USER));
- printf("\n");
+ printf("%s\n", _(" The passwd has been changed."));
} else {
- printf(_(" The passwd for '%s' has NOT been changed."), cgi_variable_nonull(SWAT_USER));
- printf("\n");
+ printf("%s\n", _(" The passwd has NOT been changed."));
}
}
@@ -1137,20 +1244,15 @@ static void chg_passwd(void)
static void passwd_page(void)
{
const char *new_name = cgi_user_name();
-
- /*
- * After the first time through here be nice. If the user
- * changed the User box text to another users name, remember it.
- */
- if (cgi_variable(SWAT_USER)) {
- new_name = cgi_variable_nonull(SWAT_USER);
- }
+ const char passwd_form[] = "passwd";
+ const char rpasswd_form[] = "rpasswd";
if (!new_name) new_name = "";
printf("<H2>%s</H2>\n", _("Server Password Management"));
printf("<FORM name=\"swatform\" method=post>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), passwd_form);
printf("<table>\n");
@@ -1190,14 +1292,16 @@ static void passwd_page(void)
* Do some work if change, add, disable or enable was
* requested. It could be this is the first time through this
* code, so there isn't anything to do. */
- if ((cgi_variable(CHG_S_PASSWD_FLAG)) || (cgi_variable(ADD_USER_FLAG)) || (cgi_variable(DELETE_USER_FLAG)) ||
- (cgi_variable(DISABLE_USER_FLAG)) || (cgi_variable(ENABLE_USER_FLAG))) {
+ if (verify_xsrf_token(passwd_form) &&
+ ((cgi_variable(CHG_S_PASSWD_FLAG)) || (cgi_variable(ADD_USER_FLAG)) || (cgi_variable(DELETE_USER_FLAG)) ||
+ (cgi_variable(DISABLE_USER_FLAG)) || (cgi_variable(ENABLE_USER_FLAG)))) {
chg_passwd();
}
printf("<H2>%s</H2>\n", _("Client/Server Password Management"));
printf("<FORM name=\"swatform\" method=post>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), rpasswd_form);
printf("<table>\n");
@@ -1230,7 +1334,7 @@ static void passwd_page(void)
* password somewhere other than the server. It could be this
* is the first time through this code, so there isn't
* anything to do. */
- if (cgi_variable(CHG_R_PASSWD_FLAG)) {
+ if (verify_xsrf_token(passwd_form) && cgi_variable(CHG_R_PASSWD_FLAG)) {
chg_passwd();
}
@@ -1247,18 +1351,15 @@ static void printers_page(void)
int i;
int mode = 0;
unsigned int parm_filter = FLAG_BASIC;
+ const char form_name[] = "printers";
+
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
if (share)
snum = lp_servicenumber(share);
- printf("<H2>%s</H2>\n", _("Printer Parameters"));
--
Samba Shared Repository
More information about the samba-cvs
mailing list