diff options
| author | Tim Beale <timbeale@catalyst.net.nz> | 2018-11-13 13:22:41 +1300 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2018-11-25 14:47:06 +0100 |
| commit | 60b2cd50f4d0554cc5ca8c53b2d1fa89e56a6d06 (patch) | |
| tree | 82824b66b624c60147a0b2fcbab436bbb36f756b | |
| parent | d12b02c78842786969557b9be7c953e9594d90dd (diff) | |
| download | samba-60b2cd50f4d0554cc5ca8c53b2d1fa89e56a6d06.tar.gz | |
CVE-2018-16857 dsdb/util: Add better default lockOutObservationWindow
Clearly the lockOutObservationWindow value is important, and using a
default value of zero doesn't work very well.
This patch adds a better default value (the domain default setting of 30
minutes).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
| -rw-r--r-- | source4/dsdb/common/util.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c index 8d863f85a29..18f700370a3 100644 --- a/source4/dsdb/common/util.c +++ b/source4/dsdb/common/util.c @@ -56,6 +56,9 @@ */ #include "dsdb/samdb/ldb_modules/util.h" +/* default is 30 minutes: -1e7 * 30 * 60 */ +#define DEFAULT_OBSERVATION_WINDOW -18000000000 + /* search the sam for the specified attributes in a specific domain, filter on objectSid being in domain_sid. @@ -5363,7 +5366,7 @@ int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb, lockOutObservationWindow = ldb_msg_find_attr_as_int64(res->msgs[0], "msDS-LockoutObservationWindow", - 0); + DEFAULT_OBSERVATION_WINDOW); talloc_free(res); } else { @@ -5402,10 +5405,11 @@ static int64_t get_lockout_observation_window(struct ldb_message *domain_msg, if (pso_msg != NULL) { return ldb_msg_find_attr_as_int64(pso_msg, "msDS-LockoutObservationWindow", - 0); + DEFAULT_OBSERVATION_WINDOW); } else { return ldb_msg_find_attr_as_int64(domain_msg, - "lockOutObservationWindow", 0); + "lockOutObservationWindow", + DEFAULT_OBSERVATION_WINDOW); } } |