diff options
| author | Tim Beale <timbeale@catalyst.net.nz> | 2018-11-13 12:24:16 +1300 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2018-11-28 08:22:25 +0100 |
| commit | c7b937c5aae40483f2f37727758ed50877f17a5b (patch) | |
| tree | 37d4a19d98378e7fcd4995b99ce3f66fa57cab50 /source4 | |
| parent | 77de8278e4b467b66a477c09945a9bcc6b08b194 (diff) | |
| download | samba-c7b937c5aae40483f2f37727758ed50877f17a5b.tar.gz | |
CVE-2018-16857 dsdb/util: Correctly treat lockOutObservationWindow as 64-bit int
Commit 442a38c918ae1666b35 refactored some code into a new
get_lockout_observation_window() function. However, in moving the code,
an ldb_msg_find_attr_as_int64() inadvertently got converted to a
ldb_msg_find_attr_as_int().
ldb_msg_find_attr_as_int() will only work for values up to -2147483648
(about 3.5 minutes in MS timestamp form). Unfortunately, the automated
tests used a low enough timeout that they still worked, however,
password lockout would not work with the Samba default settings.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683
Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4')
| -rw-r--r-- | source4/dsdb/common/util.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c index 7ce5168c6c7..dcbfc8c60a3 100644 --- a/source4/dsdb/common/util.c +++ b/source4/dsdb/common/util.c @@ -5407,12 +5407,12 @@ static int64_t get_lockout_observation_window(struct ldb_message *domain_msg, struct ldb_message *pso_msg) { if (pso_msg != NULL) { - return ldb_msg_find_attr_as_int(pso_msg, - "msDS-LockoutObservationWindow", - 0); + return ldb_msg_find_attr_as_int64(pso_msg, + "msDS-LockoutObservationWindow", + 0); } else { - return ldb_msg_find_attr_as_int(domain_msg, - "lockOutObservationWindow", 0); + return ldb_msg_find_attr_as_int64(domain_msg, + "lockOutObservationWindow", 0); } } |