===========================================================
== Subject:     Unexpected code execution in smbd.
==
== CVE ID#:     CVE-2015-0240
==
== Versions:    Samba 3.5.0 to 4.2.0rc4
==
== Summary:     Unauthenticated code execution attack on
==		smbd file services.
==
===========================================================

===========
Description
===========

All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an
unexpected code execution vulnerability in the smbd file server
daemon.

A malicious client could send packets that may set up the stack in
such a way that the freeing of memory in a subsequent anonymous
netlogon packet could allow execution of arbitrary code. This code
would execute with root privileges.

=======
Credits
=======

This problem was found by Richard van Eeden of Microsoft Vulnerability
Research, who also provided the fix.



Index: samba/source3/rpc_server/srv_netlog_nt.c
===================================================================
--- samba.orig/source3/rpc_server/srv_netlog_nt.c
+++ samba/source3/rpc_server/srv_netlog_nt.c
@@ -782,6 +782,10 @@ static NTSTATUS netr_creds_server_step_c
 		(p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY ||
 		 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY); */
 
+	if (creds_out != NULL) {
+		*creds_out = NULL;
+	}
+
 	tdb = open_schannel_session_store(mem_ctx);
 	if (!tdb) {
 		return NT_STATUS_ACCESS_DENIED;
@@ -923,7 +927,7 @@ NTSTATUS _netr_ServerPasswordSet(pipes_s
 	NTSTATUS status = NT_STATUS_OK;
 	struct samu *sampass=NULL;
 	int i;
-	struct netlogon_creds_CredentialState *creds;
+	struct netlogon_creds_CredentialState *creds = NULL;
 
 	DEBUG(5,("_netr_ServerPasswordSet: %d\n", __LINE__));
 
@@ -936,9 +940,15 @@ NTSTATUS _netr_ServerPasswordSet(pipes_s
 	unbecome_root();
 
 	if (!NT_STATUS_IS_OK(status)) {
+		const char *computer_name = "<unknown>";
+
+		if (creds != NULL && creds->computer_name != NULL) {
+			computer_name = creds->computer_name;
+		}
+
 		DEBUG(2,("_netr_ServerPasswordSet: netlogon_creds_server_step failed. Rejecting auth "
 			"request from client %s machine account %s\n",
-			r->in.computer_name, creds->computer_name));
+			r->in.computer_name, computer_name));
 		TALLOC_FREE(creds);
 		return status;
 	}
@@ -977,7 +987,7 @@ NTSTATUS _netr_ServerPasswordSet2(pipes_
 				  struct netr_ServerPasswordSet2 *r)
 {
 	NTSTATUS status;
-	struct netlogon_creds_CredentialState *creds;
+	struct netlogon_creds_CredentialState *creds = NULL;
 	struct samu *sampass;
 	DATA_BLOB plaintext;
 	struct samr_CryptPassword password_buf;
@@ -992,9 +1002,15 @@ NTSTATUS _netr_ServerPasswordSet2(pipes_
 	unbecome_root();
 
 	if (!NT_STATUS_IS_OK(status)) {
+		const char *computer_name = "<unknown>";
+
+		if (creds && creds->computer_name) {
+			computer_name = creds->computer_name;
+		}
+
 		DEBUG(2,("_netr_ServerPasswordSet2: netlogon_creds_server_step "
 			"failed. Rejecting auth request from client %s machine account %s\n",
-			r->in.computer_name, creds->computer_name));
+			r->in.computer_name, computer_name));
 		TALLOC_FREE(creds);
 		return status;
 	}
@@ -1004,6 +1020,7 @@ NTSTATUS _netr_ServerPasswordSet2(pipes_
 	netlogon_creds_arcfour_crypt(creds, password_buf.data, 516);
 
 	if (!extract_pw_from_buffer(p->mem_ctx, password_buf.data, &plaintext)) {
+		TALLOC_FREE(creds);
 		return NT_STATUS_WRONG_PASSWORD;
 	}
 
@@ -1012,6 +1029,7 @@ NTSTATUS _netr_ServerPasswordSet2(pipes_
 	status = netr_find_machine_account(p->mem_ctx,
 					   creds->account_name,
 					   &sampass);
+	TALLOC_FREE(creds);
 	if (!NT_STATUS_IS_OK(status)) {
 		return status;
 	}
