Fix for CVE-2009-2813.

===========================================================
== Subject:     Misconfigured /etc/passwd file may share folders unexpectedly
==
== CVE ID#:     CVE-2009-2813
==
== Versions:    All versions of Samba later than 3.0.11
==
== Summary:     If a user in /etc/passwd is misconfigured to have
==              an empty home directory then connecting to the home
==              share of this user will use the root of the filesystem
==              as the home directory.
===========================================================

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 553938f974f4aeff0f1468aa470394e59e1e2b57..4fd25c15bf0046d7e0c698f64753999af80039b9 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -6091,6 +6091,11 @@ bool lp_add_home(const char *pszHomename, int iDefaultService,
 {
        int i;
 
+       if (pszHomename == NULL || user == NULL || pszHomedir == NULL ||
+                       pszHomedir[0] == '\0') {
+               return false;
+       }
+
        i = add_a_service(ServicePtrs[iDefaultService], pszHomename);
 
        if (i < 0)
@@ -8062,7 +8067,7 @@ static void lp_add_auto_services(char *str)
 
                home = get_user_home_dir(talloc_tos(), p);
 
-               if (home && homes >= 0)
+               if (home && home[0] && homes >= 0)
                        lp_add_home(p, homes, p, home);
 
                TALLOC_FREE(home);

diff --git a/source3/smbd/service.c b/source3/smbd/service.c
index fc597445846fc3da7d09643229c5d8e0b4097c5b..902a7c40325844f7817b673e1435c9b7d68f56ec 100644 (file)
--- a/source3/smbd/service.c
+++ b/source3/smbd/service.c
@@ -56,6 +56,10 @@ bool set_conn_connectpath(connection_struct *conn, const char *connectpath)
        const char *s = connectpath;
         bool start_of_name_component = true;
 
+       if (connectpath == NULL || connectpath[0] == '\0') {
+               return false;
+       }
+
        destname = SMB_STRDUP(connectpath);
        if (!destname) {
                return false;
@@ -259,7 +263,7 @@ int add_home_service(const char *service, const char *username, const char *home
 {
        int iHomeService;
 
-       if (!service || !homedir)
+       if (!service || !homedir || homedir[0] == '\0')
                return -1;
 
        if ((iHomeService = lp_servicenumber(HOMES_NAME)) < 0) {