sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00
Code

CVE-2019-12435 rpc/dns: avoid NULL deference if zone not found in DnssrvOperation

Browse Source 
We still want to return DOES_NOT_EXIST when request_filter is not 0.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13922

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Douglas Bagnall 2019-05-22 12:58:01 +12:00 committed by Karolin Seeger
parent 090e8700af
commit 0b9da24753
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
python/samba/tests/dcerpc/dnsserver.py
View File

@ -28,6 +28,7 @@ from samba.dcerpc import dnsp, dnsserver, security
from samba.tests import RpcInterfaceTestCase, env_get_var_value
from samba.netcmd.dns import ARecord, AAAARecord, PTRRecord, CNameRecord, NSRecord, MXRecord, SRVRecord, TXTRecord
from samba import sd_utils, descriptor
from samba import WERRORError, werror
class DnsserverTests(RpcInterfaceTestCase):
@ -707,6 +708,30 @@ class DnsserverTests(RpcInterfaceTestCase):
'ServerInfo')
self.assertEquals(dnsserver.DNSSRV_TYPEID_SERVER_INFO, typeid)
# This test is to confirm that we do not support multizone operations,
# which are designated by a non-zero dwContext value (the 3rd argument
# to DnssrvOperation).
def test_operation_invalid(self):
non_zone = 'a-zone-that-does-not-exist'
typeid = dnsserver.DNSSRV_TYPEID_NAME_AND_PARAM
name_and_param = dnsserver.DNS_RPC_NAME_AND_PARAM()
name_and_param.pszNodeName = 'AllowUpdate'
name_and_param.dwParam = dnsp.DNS_ZONE_UPDATE_SECURE
try:
res = self.conn.DnssrvOperation(self.server,
non_zone,
1,
'ResetDwordProperty',
typeid,
name_and_param)
except WERRORError as e:
if e.args[0] == werror.WERR_DNS_ERROR_ZONE_DOES_NOT_EXIST:
return
# We should always encounter a DOES_NOT_EXIST error.
self.fail()
def test_operation2(self):
client_version = dnsserver.DNS_CLIENT_VERSION_LONGHORN
rev_zone = '1.168.192.in-addr.arpa'

7
source4/rpc_server/dnsserver/dcerpc_dnsserver.c
View File

@ -2018,7 +2018,12 @@ static WERROR dcesrv_DnssrvOperation(struct dcesrv_call_state *dce_call, TALLOC_
&r->in.pData);
} else {
z = dnsserver_find_zone(dsstate->zones, r->in.pszZone);
if (z == NULL && request_filter == 0) {
/*
* In the case that request_filter is not 0 and z is NULL,
* the request is for a multizone operation, which we do not
* yet support, so just error on NULL zone name.
*/
if (z == NULL) {
return WERR_DNS_ERROR_ZONE_DOES_NOT_EXIST;
}