aniani/elinks
1
0
Fork 0
mirror of https://github.com/rkd77/elinks.git synced 2025-01-03 14:57:44 -05:00
Code

Bug 841, CVE-2006-5925: Prevent enabling the SMB protocol.

Browse Source 
src/protocol/smb/smb.c: Added #error directives so that this
vulnerable code cannot be accidentally compiled in.

features.conf: Disable CONFIG_SMB by default and explain why.

configure.in: If the user set CONFIG_SMB in features.conf or
--enable-smb in the command line, disable them and warn the user.

(This commit combines f915c31127 and
388de7bd65 from ELinks 0.12.GIT.)
This commit is contained in:
Kalle Olavi Niemitalo 2006-11-18 22:17:58 +02:00 committed by Kalle Olavi Niemitalo
parent 8789b7c330
commit 6f14725204
3 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
configure.in
View File

@ -1123,8 +1123,17 @@ EL_ARG_ENABLE(CONFIG_GOPHER, gopher, [Gopher protocol],
EL_ARG_ENABLE(CONFIG_NNTP, nntp, [NNTP protocol],
[ --enable-nntp enable nntp protocol support])
dnl Force disable SMB before EL_ARG_DEPEND so that it logs the correct value.
if test "${enable_smb-no}" != no || test "${CONFIG_SMB-no}" != no; then
AC_MSG_WARN([Forcing --disable-smb because of vulnerability CVE-2006-5925.
If you want to use SMB, please vote for bug 844 or post a patch.])
fi
enable_smb=no
CONFIG_SMB=no
EL_ARG_DEPEND(CONFIG_SMB, smb, [HAVE_SMBCLIENT:yes], [SMB protocol],
[ --disable-smb disable SMB protocol support (requires smbclient)])
[ --enable-smb not currently allowed])
dnl EL_ARG_DEPEND(CONFIG_SMB, smb, [HAVE_SMBCLIENT:yes], [SMB protocol],
dnl [ --disable-smb disable SMB protocol support (requires smbclient)])
EL_ARG_ENABLE(CONFIG_MOUSE, mouse, [Mouse handling],

10
features.conf
View File

@ -373,9 +373,15 @@ CONFIG_NNTP=no
# will need to install Samba (or at least just the smbclient part, if you can
# install it separately).
#
# Default: enabled if smbclient will be found
# Unfortunately, ELinks doesn't yet properly validate the file name passed to
# smbclient, and this caused vulnerability CVE-2006-5925 (bug 841). To close
# the vulnerability, configure.in now disables the SMB protocol regardless
# of what you specify here. If you would like to fix the code so that the
# protocol can be safely enabled again, please see bug 844.
#
# Default: disabled
CONFIG_SMB=yes
CONFIG_SMB=no
### Cascading Style Sheets

3
src/protocol/smb/smb.c
View File

@ -4,6 +4,9 @@
#define _GNU_SOURCE /* Needed for asprintf() */
#endif
#error SMB protocol support is vulnerable to CVE-2006-5925. Do not use.
#error If you want to use SMB, please vote for bug 844 or post a patch.
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif