| commit | 7cc374973406c49130fff019de26bdf0db48f494 | |
| author | Ralph Boehme <slow@samba.org> | |
| Thu, 22 Feb 2018 09:54:37 +0000 (22 10:54 +0100) | ||
| committer | Karolin Seeger <kseeger@samba.org> | |
| Tue, 13 Mar 2018 09:25:39 +0000 (13 10:25 +0100) | ||
| tree | caa2552ac571f70a800a1d0921b7426e77b8f5de | treesnapshot (tar.gz zip) |
| parent | a192242f81bf21096ee497805cd63ad43ee20515 | commitdiff |
CVE-2018-1057: s4/dsdb: correctly detect password resets
This change ensures we correctly treat the following LDIF
dn: cn=testuser,cn=users,...
changetype: modify
delete: userPassword
add: userPassword
userPassword: thatsAcomplPASS1
as a password reset. Because delete and add element counts are both
one, the ACL module wrongly treated this as a password change
request.
For a password change we need at least one value to delete and one value
to add. This patch ensures we correctly check attributes and their
values.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
This change ensures we correctly treat the following LDIF
dn: cn=testuser,cn=users,...
changetype: modify
delete: userPassword
add: userPassword
userPassword: thatsAcomplPASS1
as a password reset. Because delete and add element counts are both
one, the ACL module wrongly treated this as a password change
request.
For a password change we need at least one value to delete and one value
to add. This patch ensures we correctly check attributes and their
values.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
| selftest/knownfail.d/samba4.ldap.passwords.python | [deleted file] | blobblamehistory |
| source4/dsdb/samdb/ldb_modules/acl.c | diffblobblamehistory |