diff options
| author | Noel Power <noel.power@suse.com> | 2013-10-16 16:30:55 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2013-12-05 11:11:57 +0100 |
| commit | 3b61be8a4b06f929c1bd52c1b8016f9a4fff9be1 (patch) | |
| tree | fede611777422ed31fb0d72240e3bf50a696ef16 | |
| parent | 50e3da9992e4a43b888caa3aeadfbf5293e8281a (diff) | |
| download | samba-3b61be8a4b06f929c1bd52c1b8016f9a4fff9be1.tar.gz | |
CVE-2012-6150: Fail authentication for single group name which cannot be converted to sid
furthermore if more than one name is supplied and no sid is converted
then also fail.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10300
Bug: https://bugzilla.samba.org/show_bug.cgi?id=10306
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>
[ddiss@samba.org: fixed incorrect bugzilla tag I added to master commit]
| -rw-r--r-- | nsswitch/pam_winbind.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c index d1264943a79..8f5ad507523 100644 --- a/nsswitch/pam_winbind.c +++ b/nsswitch/pam_winbind.c @@ -1184,6 +1184,12 @@ static bool winbind_name_list_to_sid_string_list(struct pwb_context *ctx, _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s " "to sid, please contact your administrator to see " "if group %s is valid."), search_location, search_location); + + /* If no valid groups were converted we should fail outright */ + if (name_list != NULL && strlen(sid_list_buffer) == 0) { + result = false; + goto out; + } /* * The lookup of the last name failed.. * It results in require_member_of_sid ends with ',' |