From d2bc9f3afe23ee04d237ae9f4511fbe59a27ff54 Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Mon, 8 May 2017 21:40:40 +0200 Subject: [PATCH] CVE-2017-7494: rpc_server3: Refuse to open pipe names with / inside Bug: https://bugzilla.samba.org/show_bug.cgi?id=12780 Signed-off-by: Volker Lendecke Reviewed-by: Jeremy Allison Reviewed-by: Stefan Metzmacher --- source3/rpc_server/srv_pipe.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index 0633b5f..c3f0cd8 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -475,6 +475,11 @@ bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax) { NTSTATUS status; + if (strchr(pipename, '/')) { + DEBUG(1, ("Refusing open on pipe %s\n", pipename)); + return false; + } + if (lp_disable_spoolss() && strequal(pipename, "spoolss")) { DEBUG(10, ("refusing spoolss access\n")); return false; -- 1.9.1