Ralph Boehme 3c432b1446 CVE-2023-4091: smbd: use open_access_mask for access check in open_file() ...

If the client requested FILE_OVERWRITE[_IF], we're implicitly adding
FILE_WRITE_DATA to the open_access_mask in open_file_ntcreate(), but for the
access check we're using access_mask which doesn't contain the additional
right, which means we can end up truncating a file for which the user has
only read-only access via an SD.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15439

Signed-off-by: Ralph Boehme <slow@samba.org>

2023-10-09 22:15:19 +02:00

..

auth

s3:auth: call wbcFreeMemory(info) in auth3_generate_session_info_pac()

2023-01-31 11:45:17 +00:00

build

…

client

smbclient: Fix fd leak with "showacls;ls"

2023-06-12 08:25:18 +00:00

exports

…

groupdb

lib: relicense smb_strtoul(l) under LGPLv3

2020-08-03 22:21:02 +00:00

include

libsmb: fix regression on smbc_getxattr and fix doc

2023-09-06 08:35:16 +00:00

intl

lib: Remove "tdb based replacement for gettext"

2019-05-22 05:59:13 +00:00

lib

libadouble: allow FILE_SHARE_DELETE in ad_convert_xattr()

2023-05-31 09:47:11 +00:00

libads

s3:libads: re-initialize num_requests to 0 for cldap_ping_list retries

2023-07-06 11:56:19 +00:00

libgpo/gpext

Spelling fixes s/emtpy/empty/

2019-09-01 22:21:26 +00:00

libnet

s3-net: no secrets access required when processing a ODJ provisioning

2023-07-19 15:14:13 +00:00

librpc

rpc: Remove named_pipe_auth_req_info6->need_idle_server

2023-05-26 12:34:17 +00:00

libsmb

libsmb: fix regression on smbc_getxattr and fix doc

2023-09-06 08:35:16 +00:00

locale

spelling: connnect encrytion exisit expection explicit invalide missmatch paramater paramter partion privilige relase reponse seperate unkown verson authencication progagated

2022-06-10 18:12:33 +00:00

locking

s3:locking: fix debug level for NT_STATUS_NOT_FOUND messanges in get_static_share_mode_data

2023-05-09 13:15:57 +00:00

modules

vfs_aio_pthread: use SMB_VFS_NEXT_OPENAT() in aio_pthread_openat_fn()

2023-09-04 09:49:30 +00:00

nmbd

smbd: remove process shortname arg from reinit_after_fork()

2022-12-14 01:38:29 +00:00

param

CVE-2023-0922 set default ldap client sasl wrapping to seal

2023-03-20 10:05:12 +01:00

passdb

dsdb: Use samdb_system_container_dn() in pdb_samba_dsdb_*()

2023-08-01 10:57:04 +00:00

printing

s3-librpc: add ads.idl and convert ads_struct to talloc.

2022-12-16 20:38:32 +00:00

profile

s3:profile: make use of tevent_cached_getpid() in performance critical code

2022-07-25 18:32:18 +00:00

registry

lib: Move tab_depth() to reg_parse_prs.c

2023-01-10 00:28:37 +00:00

rpc_client

CVE-2023-3961:s3: smbd: Remove the SMB_ASSERT() that crashes on bad pipenames.

2023-10-09 22:15:19 +02:00

rpc_server

mdssvc: better support for search with mdfind from Macs

2023-09-05 09:28:33 +00:00

rpcclient

CVE-2023-34968: mdssvc: introduce an allocating wrapper to sl_pack()

2023-07-14 15:12:34 +02:00

script

s3: torture: Add a new SMB2 test: SMB2-PIPE-READ-ASYNC-DISCONNECT

2023-09-20 20:35:15 +00:00

selftest

CVE-2023-3961:s3:torture: Add test SMB2-INVALID-PIPENAME to show we allow bad pipenames with unix separators through to the UNIX domain socket code.

2023-10-09 22:15:19 +02:00

services

s3:services: Disable rcinit-based service control code

2021-12-10 14:02:30 +00:00

smbd

CVE-2023-4091: smbd: use open_access_mask for access check in open_file()

2023-10-09 22:15:19 +02:00

torture

CVE-2023-3961:s3:torture: Add test SMB2-INVALID-PIPENAME to show we allow bad pipenames with unix separators through to the UNIX domain socket code.

2023-10-09 22:15:19 +02:00

utils

CVE-2022-2127: ntlm_auth: cap lanman response length value

2023-07-14 15:12:10 +02:00

web

…

winbindd

s3:winbindd: Fix double close(fd)

2023-07-28 13:37:01 +00:00

.clang_complete

…

.dmallocrc

…

.indent.pro

…

Doxyfile

…

mainpage.dox

…

smbadduser.in

…

wscript

selftest: Only run samba.tests.smb3unix in developer mode

2023-02-10 10:52:15 +00:00

wscript_build

build: Don't compile source3/lib/util_sd.c four times

2023-01-12 15:38:30 +00:00

wscript_configure_system_ncurses

…