diff options
| author | Tim Beale <timbeale@catalyst.net.nz> | 2018-11-13 12:24:16 +1300 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2018-11-25 14:47:06 +0100 |
| commit | 4f86beeaf3408383385ee99a74520a805dd63c0f (patch) | |
| tree | 06bba40d5f5db0f7fc3f4fb2b91e8908dabac0ef /source4 | |
| parent | ec9cc4ed5a05490297cde3fcaac50eeeaaca8469 (diff) | |
| download | samba-4f86beeaf3408383385ee99a74520a805dd63c0f.tar.gz | |
CVE-2018-16857 dsdb/util: Correctly treat lockOutObservationWindow as 64-bit int
Commit 442a38c918ae1666b35 refactored some code into a new
get_lockout_observation_window() function. However, in moving the code,
an ldb_msg_find_attr_as_int64() inadvertently got converted to a
ldb_msg_find_attr_as_int().
ldb_msg_find_attr_as_int() will only work for values up to -2147483648
(about 3.5 minutes in MS timestamp form). Unfortunately, the automated
tests used a low enough timeout that they still worked, however,
password lockout would not work with the Samba default settings.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/dsdb/common/util.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c index 193fa2ae653..438a29e1773 100644 --- a/source4/dsdb/common/util.c +++ b/source4/dsdb/common/util.c @@ -5400,12 +5400,12 @@ static int64_t get_lockout_observation_window(struct ldb_message *domain_msg, struct ldb_message *pso_msg) { if (pso_msg != NULL) { - return ldb_msg_find_attr_as_int(pso_msg, - "msDS-LockoutObservationWindow", - 0); + return ldb_msg_find_attr_as_int64(pso_msg, + "msDS-LockoutObservationWindow", + 0); } else { - return ldb_msg_find_attr_as_int(domain_msg, - "lockOutObservationWindow", 0); + return ldb_msg_find_attr_as_int64(domain_msg, + "lockOutObservationWindow", 0); } } |