summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* ldb: Release LDB 1.3.6ldb-1.3.6Andrew Bartlett2018-08-234-1/+284
| | | | | | * make test fails on ldb 1.3.4 due to missing NULL terminator in tests (bug 13575) Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* ldb: Fix missing NULL terminator in ldb_mod_op_test testsuiteAndrew Bartlett2018-08-231-2/+2
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13575 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> (cherry picked from commit f8b368c9f0c2a34b6d15303a9d6facd762e1a517)
* libsmb: Fix CID 1438243 Unchecked return valueVolker Lendecke2018-08-231-1/+8
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13553 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Aug 8 23:10:22 CEST 2018 on sn-devel-144
* libsmb: Fix CID 1438244 Unsigned compared against 0Volker Lendecke2018-08-231-4/+0
| | | | | | | | | | | | ndr_size_dom_sid returns a size_t, so that can't be <0. Also, the only case that ndr_size_dom_sid returns 0 is a NULL sid pointer. ndr_size_dom_sid can reasonably be assumed to not overflow, the number of sub-auths is a uint8. That times 4 plus 8 always fits into a size_t. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13553 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* smbd: Fix CID 1438245 Dereference before null checkVolker Lendecke2018-08-231-1/+1
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13553 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* smbd: Fix CID 1438246 Unchecked return valueVolker Lendecke2018-08-231-1/+10
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13553 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* smbd: Align integer typesVolker Lendecke2018-08-231-1/+1
| | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13553 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* ctdb: add expiry test for ctdb_mutex_ceph_rados_helperDavid Disseldorp2018-08-231-1/+56
| | | | | | | | | | | | | | Kill the ctdb_mutex_ceph_rados_helper with SIGKILL and then confirm that the lock is automatically released following expiry. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Amitay Isaacs <amitay@gmail.com> Autobuild-User(master): David Disseldorp <ddiss@samba.org> Autobuild-Date(master): Thu Aug 9 16:26:36 CEST 2018 on sn-devel-144 (cherry picked from commit 4abf348ec4cbb78d3216d5e8c5f3020d4499f10a)
* ctdb_mutex_ceph_rados_helper: fix deadlock via lock renewalsDavid Disseldorp2018-08-231-9/+98
| | | | | | | | | | | | | | | | RADOS locks without expiry persist indefinitely. This results in CTDB deadlock during failover if the recovery master dies unexpectedly, as subsequently elected recovery master nodes can't obtain the recovery lock. Avoid deadlock by using a lock expiration time (10s by default), and renewing it periodically. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13540 Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Amitay Isaacs <amitay@gmail.com> (cherry picked from commit ce289e89e5c469cf2c5626dc7f2666b945dba3bd)
* ctdb_mutex_ceph_rados_helper: rename timer_ev to ppid_timer_evDavid Disseldorp2018-08-231-12/+13
| | | | | | | | | In preparation for adding a lock refresh timer. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Amitay Isaacs <amitay@gmail.com> (cherry picked from commit 91a89c146453ca203a83dc2ba555bb93276c4d7f)
* ctdb_mutex_ceph_rados_helper: use talloc destructor for cleanupDavid Disseldorp2018-08-231-27/+24
| | | | | | | Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: Amitay Isaacs <amitay@gmail.com> (cherry picked from commit 8d30fd591600ac17c742cd78c7bc4056bba6b877)
* ctdb_mutex_ceph_rados_helper: Set SIGINT signal handlerSamuel Cabrero2018-08-231-4/+15
| | | | | | | | | Set a handler for SIGINT to release the lock. Signed-off-by: Samuel Cabrero <scabrero@suse.de> Reviewed-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Amitay Isaacs <amitay@gmail.com> (cherry picked from commit 85706bd27535eaa4ec653f99b1910fbd8f2aab88)
* ctdb/build: link ctdb_mutex_ceph_rados_helper against ceph-commonDavid Disseldorp2018-08-231-1/+13
| | | | | | | | | ceph-common linkage is needed with new versions of Ceph. Also respect the --libcephfs_dir=<path> parameter when provided. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Amitay Isaacs <amitay@gmail.com> (cherry picked from commit bd64af6b8861f892e6ae2840a493f037d1e0a06c)
* docs: Add manpage for winbind_krb5_localauth.8Andreas Schneider2018-08-232-0/+90
| | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13489 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed Jun 27 18:45:56 CEST 2018 on sn-devel-144 (cherry picked from commit e88d68c253b4398eaed701d1a9bcc1b83882e127)
* docs: Move winbind_krb5_locator manpage to volume 8Andreas Schneider2018-08-232-4/+4
| | | | | | | | | | The vfs and idmap manpages are in volume 8 too. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13489 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> (cherry picked from commit 6b7fcec01524ea1c4f2d923cc9cc2c17af3c3a21)
* krb5_plugin: Move krb5 locator plugin to krb5_plugin subdirAndreas Schneider2018-08-232-1/+1
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13489 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> (cherry picked from commit 4a7e0f259bb7f1ebce48523767262addda08fe14)
* krb5_plugin: Install plugins to krb5 modules dirAndreas Schneider2018-08-231-5/+7
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13489 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Alexander Bokovoy <ab@samba.org> (cherry picked from commit eba2eb8a15c7a25b1436907a5339241492c81097)
* s3: tests: smbclient. Regression test to ensure we get ↵Jeremy Allison2018-08-231-0/+42
| | | | | | | | | | | | | | NT_STATUS_DIRECTORY_NOT_EMPTY on rmdir. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13204 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Aug 10 21:08:14 CEST 2018 on sn-devel-144 (cherry picked from commit bca400847f2fcc3dd1398e166c1964cb88822071)
* s4/torture: Add new test for DELETE_ON_CLOSE on non-empty directoriesAnoop C S2018-08-231-0/+87
| | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13204 Signed-off-by: Anoop C S <anoopcs@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> (cherry picked from commit 6a7f11746c9cc3cdc5307e540bdd1f3f10fed05b)
* s3/libsmb: Explicitly set delete_on_close token for rmdirAnoop C S2018-08-231-1/+8
| | | | | | | | | | | | | | | | | | | | | The current implementation of `rmdir` hopes to get the directory deleted on closing last open handle when FILE_DELETE_ON_CLOSE is set on it. But for non-empty directories Windows doesn't error out during an open call. Following that we internally refuse to set initial delete_on_close while opening a non-empty directory. This prevents us from trying to delete the directory when last open handle is closed. Instead of relying on FILE_DELETE_ON_CLOSE during an open we explicitly set delete_on_close token on directory handle once it is available. This ensures that NT_STATUS_DIRECTORY_NOT_EMPTY is returned for `rmdir` on non-empty directories while closing open directory handle. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13204 Signed-off-by: Anoop C S <anoopcs@redhat.com> Reviewed-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> (cherry picked from commit 6b68e3eca631c04d6d57c489daf60f64732fc86d)
* VERSION: Bump version up to 4.8.5.Karolin Seeger2018-08-141-1/+1
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* Merge tag 'samba-4.8.4' into v4-8-testKarolin Seeger2018-08-1428-94/+2720
|\ | | | | | | samba: tag release samba-4.8.4
| * VERSION: Disable GIT_SNAPSHOT for the Samba 4.8.4 release.samba-4.8.4Karolin Seeger2018-08-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | o CVE-2018-1139 (Weak authentication protocol allowed.) o CVE-2018-1140 (Denial of Service Attack on DNS and LDAP server.) o CVE-2018-10858 (Insufficient input validation on client directory listing in libsmbclient.) o CVE-2018-10918 (Denial of Service Attack on AD DC DRSUAPI server.) o CVE-2018-10919 (Confidential attribute disclosure from the AD LDAP server.) Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * WHATSNEW: Add release notes for Samba 4.8.4.Karolin Seeger2018-08-111-2/+92
| | | | | | | | | | | | | | | | | | | | | | | | o CVE-2018-1139 (Weak authentication protocol allowed.) o CVE-2018-1140 (Denial of Service Attack on DNS and LDAP server.) o CVE-2018-10858 (Insufficient input validation on client directory listing in libsmbclient.) o CVE-2018-10918 (Denial of Service Attack on AD DC DRSUAPI server.) o CVE-2018-10919 (Confidential attribute disclosure from the AD LDAP server.) Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * CVE-2018-1140 dns: Add a test to trigger the LDB casefolding issue on ↵Kai Blin2018-08-112-0/+90
| | | | | | | | | | | | | | | | | | invalid chars BUG: https://bugzilla.samba.org/show_bug.cgi?id=13466 Signed-off-by: Kai Blin <kai@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
| * ldb: Release LDB 1.3.5 for CVE-2018-1140ldb-1.3.5Andrew Bartlett2018-08-114-1/+284
| | | | | | | | | | | | | | * Security fix for CVE-2018-1140 (NULL pointer de-reference, bug 13374) Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
| * CVE-2018-1140 ldb: Add tests for search add and rename with a bad dn= DNAndrew Bartlett2018-08-111-0/+156
| | | | | | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=13374
| * CVE-2018-1140 ldb_tdb: Check for DN validity in add, rename and searchAndrew Bartlett2018-08-112-1/+42
| | | | | | | | | | | | | | | | | | This ensures we fail with a good error code before an eventual ldb_dn_get_casefold() which would otherwise fail. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=13374
| * CVE-2018-1140 ldb_tdb: Ensure the dn in distinguishedName= is valid before useAndrew Bartlett2018-08-111-0/+9
| | | | | | | | | | | | | | | | | | ldb_dn_from_ldb_val() does not validate this untrusted input, so a later call to ldb_dn_get_casefold() can fail if the input is not valid. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=13374
| * CVE-2018-1140 ldb: Check for ldb_dn_get_casefold() failure in ldb_sqliteAndrew Bartlett2018-08-111-0/+3
| | | | | | | | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=13374
| * CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr()Andrej Gessel2018-08-111-0/+9
| | | | | | | | | | | | | | Signed-off-by: Andrej Gessel <Andrej.Gessel@janztec.com> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=13374
| * CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled ↵Günther Deschner2018-08-113-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | via "ntlm auth". This fixes a regression that came in via 00db3aba6cf9ebaafdf39ee2f9c7ba5ec2281ea0. Found by Vivek Das <vdas@redhat.com> (Red Hat QE). In order to demonstrate simply run: smbclient //server/share -U user%password -mNT1 -c quit \ --option="client ntlmv2 auth"=no \ --option="client use spnego"=no against a server that uses "ntlm auth = ntlmv2-only" (our default setting). BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 CVE-2018-1139: Weak authentication protocol allowed. Guenther Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
| * CVE-2018-1139 selftest: verify whether ntlmv1 can be used via SMB1 when it ↵Günther Deschner2018-08-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | is disabled. Right now, this test will succeed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 CVE-2018-1139: Weak authentication protocol allowed. Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
| * CVE-2018-1139 s3-utils: use enum ntlm_auth_level in ntlm_password_check().Günther Deschner2018-08-111-2/+4
| | | | | | | | | | | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 CVE-2018-1139: Weak authentication protocol allowed. Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
| * CVE-2018-1139 libcli/auth: fix debug messages in hash_password_check()Günther Deschner2018-08-111-4/+4
| | | | | | | | | | | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 CVE-2018-1139: Weak authentication protocol allowed. Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
| * CVE-2018-1139 libcli/auth: Add initial tests for ntlm_password_check()Andrew Bartlett2018-08-114-0/+430
| | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13360 Signed-off-by: Andrew Bartlett <abartlet@samba.org>
| * selftest/tests.py: remove always-needed, never-set with_cmocka flagDouglas Bagnall2018-08-111-10/+8
| | | | | | | | | | | | | | | | | | | | We have cmocka in third_party, so we are never without it. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (Backported from commit 33ef0e57a4f08eae5ea06f482374fbc0a1014de6 by Andrew Bartlett)
| * CVE-2018-10919 tests: Add extra test for dirsync deleted object corner-caseTim Beale2018-08-111-26/+131
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The acl_read.c code contains a special case to allow dirsync to work-around having insufficient access rights. We had a concern that the dirsync module could leak sensitive information for deleted objects. This patch adds a test-case to prove whether or not this is happening. The new test case is similar to the existing dirsync test except: - We make the confidential attribute also preserve-on-delete, so it hangs around for deleted objcts. Because the attributes now persist across test case runs, I've used a different attribute to normal. (Technically, the dirsync search expressions are now specific enough that the regular attribute could be used, but it would make things quite fragile if someone tried to add a new test case). - To handle searching for deleted objects, the search expressions are now more complicated. Currently dirsync adds an extra-filter to the '!' searches to exclude deleted objects, i.e. samaccountname matches the test-objects AND the object is not deleted. We now extend this to include deleted objects with lastKnownParent equal to the test OU. The search expression matches either case so that we can use the same expression throughout the test (regardless of whether the object is deleted yet or not). This test proves that the dirsync corner-case does not actually leak sensitive information on Samba. This is due to a bug in the dirsync code - when the buggy line is removed, this new test promptly fails. Test also passes against Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 acl_read: Fix unauthorized attribute access via searchesTim Beale2018-08-113-16/+247
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A user that doesn't have access to view an attribute can still guess the attribute's value via repeated LDAP searches. This affects confidential attributes, as well as ACLs applied to an object/attribute to deny access. Currently the code will hide objects if the attribute filter contains an attribute they are not authorized to see. However, the code still returns objects as results if confidential attribute is in the search expression itself, but not in the attribute filter. To fix this problem we have to check the access rights on the attributes in the search-tree, as well as the attributes returned in the message. Points of note: - I've preserved the existing dirsync logic (the dirsync module code suppresses the result as long as the replPropertyMetaData attribute is removed). However, there doesn't appear to be any test that highlights that this functionality is required for dirsync. - To avoid this fix breaking the acl.py tests, we need to still permit searches like 'objectClass=*', even though we don't have Read Property access rights for the objectClass attribute. The logic that Windows uses does not appear to be clearly documented, so I've made a best guess that seems to mirror Windows behaviour. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 acl_read: Flip the logic in the dirsync checkTim Beale2018-08-111-10/+7
| | | | | | | | | | | | | | | | | | This better reflects the special case we're making for dirsync, and gets rid of a 'if-else' clause. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 acl_read: Small refactor to aclread_callback()Tim Beale2018-08-111-14/+17
| | | | | | | | | | | | | | | | | | Flip the dirsync check (to avoid a double negative), and use a helper boolean variable. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 acl_read: Split access_mask logic out into helper functionTim Beale2018-08-111-19/+35
| | | | | | | | | | | | | | | | So we can re-use the same logic laster for checking the search-ops. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 tests: test ldap searches for non-existent attributes.Gary Lockyer2018-08-111-0/+9
| | | | | | | | | | | | | | | | | | It is perfectly legal to search LDAP for an attribute that is not part of the schema. That part of the query should simply not match. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 security: Fix checking of object-specific CONTROL_ACCESS rightsTim Beale2018-08-111-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An 'Object Access Allowed' ACE that assigned 'Control Access' (CR) rights to a specific attribute would not actually grant access. What was happening was the remaining_access mask for the object_tree nodes would be Read Property (RP) + Control Access (CR). The ACE mapped to the schemaIDGUID for a given attribute, which would end up being a child node in the tree. So the CR bit was cleared for a child node, but not the rest of the tree. We would then check the user had the RP access right, which it did. However, the RP right was cleared for another node in the tree, which still had the CR bit set in its remaining_access bitmap, so Samba would not grant access. Generally, the remaining_access only ever has one bit set, which means this isn't a problem normally. However, in the Control Access case there are 2 separate bits being checked, i.e. RP + CR. One option to fix this problem would be to clear the remaining_access for the tree instead of just the node. However, the Windows spec is actually pretty clear on this: if the ACE has a CR right present, then you can stop any further access checks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 tests: Add test case for object visibility with limited rightsTim Beale2018-08-112-0/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently Samba is a bit disclosive with LDB_OP_PRESENT (i.e. attribute=*) searches compared to Windows. All the acl.py tests are based on objectClass=* searches, where Windows will happily tell a user about objects they have List Contents rights, but not Read Property rights for. However, if you change the attribute being searched for, suddenly the objects are no longer visible on Windows (whereas they are on Samba). This is a problem, because Samba can tell you about which objects have confidential attributes, which in itself could be disclosive. This patch adds a acl.py test-case that highlights this behaviour. The test passes against Windows but fails against Samba. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 tests: Add tests for guessing confidential attributesTim Beale2018-08-113-0/+938
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds tests that assert that a confidential attribute cannot be guessed by an unprivileged user through wildcard DB searches. The tests basically consist of a set of DB searches/assertions that get run for: - basic searches against a confidential attribute - confidential attributes that get overridden by giving access to the user via an ACE (run against a variety of ACEs) - protecting a non-confidential attribute via an ACL that denies read- access (run against a variety of ACEs) - querying confidential attributes via the dirsync controls These tests all pass when run against a Windows Dc and all fail against a Samba DC. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 security: Add more comments to the object-specific access checksTim Beale2018-08-111-8/+22
| | | | | | | | | | | | | | | | | | Reading the spec and then reading the code makes sense, but we could comment the code more so it makes sense on its own. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10919 security: Move object-specific access checks into separate ↵Tim Beale2018-08-111-27/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | function Object-specific access checks refer to a specific section of the MS-ADTS, and the code closely matches the spec. We need to extend this logic to properly handle the Control-Access Right (CR), so it makes sense to split the logic out into its own function. This patch just moves the code, and should not alter the logic (apart from ading in the boolean grant_access return variable. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
| * CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not ↵Andrew Bartlett2018-08-112-1/+45
| | | | | | | | | | | | | | | | | | | | | | | | | | | | servicePrincipalName is set on a user This regression was introduced in Samba 4.7 by bug 12842 and in master git commit eb2e77970e41c1cb62c041877565e939c78ff52d. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13552 CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from ↵Jeremy Allison2018-08-112-8/+51
| | | | | | | | | | | | | | | | | | | | | | | | malicious servers. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13453 CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
View Lorry Controller Status