summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* VERSION: Bump version up to 4.6.17.v4-6-testKarolin Seeger2018-08-141-1/+1
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* Merge tag 'samba-4.6.16' into v4-6-testKarolin Seeger2018-08-149-73/+1607
|\ | | | | | | samba: tag release samba-4.6.16
| * VERSION: Disable GIT_SNAPSHOT for the 4.6.16 release.samba-4.6.16v4-6-stableKarolin Seeger2018-08-131-1/+1
| | | | | | | | | | | | | | | | | | o CVE-2018-10858 (Insufficient input validation on client directory listing in libsmbclient.) o CVE-2018-10919 (Confidential attribute disclosure from the AD LDAP server.) Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * WHATSNEW: Add release notes for Samba 4.6.16.Karolin Seeger2018-08-131-2/+64
| | | | | | | | | | | | | | | | | | o CVE-2018-10858 (Insufficient input validation on client directory listing in libsmbclient.) o CVE-2018-10919 (Confidential attribute disclosure from the AD LDAP server.) Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * CVE-2018-10919 tests: Add extra test for dirsync deleted object corner-caseTim Beale2018-08-131-26/+131
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The acl_read.c code contains a special case to allow dirsync to work-around having insufficient access rights. We had a concern that the dirsync module could leak sensitive information for deleted objects. This patch adds a test-case to prove whether or not this is happening. The new test case is similar to the existing dirsync test except: - We make the confidential attribute also preserve-on-delete, so it hangs around for deleted objcts. Because the attributes now persist across test case runs, I've used a different attribute to normal. (Technically, the dirsync search expressions are now specific enough that the regular attribute could be used, but it would make things quite fragile if someone tried to add a new test case). - To handle searching for deleted objects, the search expressions are now more complicated. Currently dirsync adds an extra-filter to the '!' searches to exclude deleted objects, i.e. samaccountname matches the test-objects AND the object is not deleted. We now extend this to include deleted objects with lastKnownParent equal to the test OU. The search expression matches either case so that we can use the same expression throughout the test (regardless of whether the object is deleted yet or not). This test proves that the dirsync corner-case does not actually leak sensitive information on Samba. This is due to a bug in the dirsync code - when the buggy line is removed, this new test promptly fails. Test also passes against Windows. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 acl_read: Fix unauthorized attribute access via searchesTim Beale2018-08-133-16/+247
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A user that doesn't have access to view an attribute can still guess the attribute's value via repeated LDAP searches. This affects confidential attributes, as well as ACLs applied to an object/attribute to deny access. Currently the code will hide objects if the attribute filter contains an attribute they are not authorized to see. However, the code still returns objects as results if confidential attribute is in the search expression itself, but not in the attribute filter. To fix this problem we have to check the access rights on the attributes in the search-tree, as well as the attributes returned in the message. Points of note: - I've preserved the existing dirsync logic (the dirsync module code suppresses the result as long as the replPropertyMetaData attribute is removed). However, there doesn't appear to be any test that highlights that this functionality is required for dirsync. - To avoid this fix breaking the acl.py tests, we need to still permit searches like 'objectClass=*', even though we don't have Read Property access rights for the objectClass attribute. The logic that Windows uses does not appear to be clearly documented, so I've made a best guess that seems to mirror Windows behaviour. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 acl_read: Flip the logic in the dirsync checkTim Beale2018-08-131-10/+7
| | | | | | | | | | | | | | | | | | | | | | This better reflects the special case we're making for dirsync, and gets rid of a 'if-else' clause. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 acl_read: Small refactor to aclread_callback()Tim Beale2018-08-131-14/+17
| | | | | | | | | | | | | | | | | | | | | | Flip the dirsync check (to avoid a double negative), and use a helper boolean variable. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 acl_read: Split access_mask logic out into helper functionTim Beale2018-08-131-20/+36
| | | | | | | | | | | | | | | | | | | | So we can re-use the same logic laster for checking the search-ops. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 security: Fix checking of object-specific CONTROL_ACCESS rightsTim Beale2018-08-131-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | An 'Object Access Allowed' ACE that assigned 'Control Access' (CR) rights to a specific attribute would not actually grant access. What was happening was the remaining_access mask for the object_tree nodes would be Read Property (RP) + Control Access (CR). The ACE mapped to the schemaIDGUID for a given attribute, which would end up being a child node in the tree. So the CR bit was cleared for a child node, but not the rest of the tree. We would then check the user had the RP access right, which it did. However, the RP right was cleared for another node in the tree, which still had the CR bit set in its remaining_access bitmap, so Samba would not grant access. Generally, the remaining_access only ever has one bit set, which means this isn't a problem normally. However, in the Control Access case there are 2 separate bits being checked, i.e. RP + CR. One option to fix this problem would be to clear the remaining_access for the tree instead of just the node. However, the Windows spec is actually pretty clear on this: if the ACE has a CR right present, then you can stop any further access checks. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 tests: test ldap searches for non-existent attributes.Gary Lockyer2018-08-131-0/+9
| | | | | | | | | | | | | | | | | | | | It is perfectly legal to search LDAP for an attribute that is not part of the schema. That part of the query should simply not match. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
| * CVE-2018-10919 tests: Add test case for object visibility with limited rightsTim Beale2018-08-132-0/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently Samba is a bit disclosive with LDB_OP_PRESENT (i.e. attribute=*) searches compared to Windows. All the acl.py tests are based on objectClass=* searches, where Windows will happily tell a user about objects they have List Contents rights, but not Read Property rights for. However, if you change the attribute being searched for, suddenly the objects are no longer visible on Windows (whereas they are on Samba). This is a problem, because Samba can tell you about which objects have confidential attributes, which in itself could be disclosive. This patch adds a acl.py test-case that highlights this behaviour. The test passes against Windows but fails against Samba. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 tests: Add tests for guessing confidential attributesTim Beale2018-08-133-0/+938
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds tests that assert that a confidential attribute cannot be guessed by an unprivileged user through wildcard DB searches. The tests basically consist of a set of DB searches/assertions that get run for: - basic searches against a confidential attribute - confidential attributes that get overridden by giving access to the user via an ACE (run against a variety of ACEs) - protecting a non-confidential attribute via an ACL that denies read- access (run against a variety of ACEs) - querying confidential attributes via the dirsync controls These tests all pass when run against a Windows Dc and all fail against a Samba DC. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 security: Add more comments to the object-specific access checksTim Beale2018-08-131-8/+22
| | | | | | | | | | | | | | | | | | | | | | Reading the spec and then reading the code makes sense, but we could comment the code more so it makes sense on its own. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10919 security: Move object-specific access checks into separate ↵Tim Beale2018-08-131-27/+59
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | function Object-specific access checks refer to a specific section of the MS-ADTS, and the code closely matches the spec. We need to extend this logic to properly handle the Control-Access Right (CR), so it makes sense to split the logic out into its own function. This patch just moves the code, and should not alter the logic (apart from ading in the boolean grant_access return variable. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
| * CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from ↵Jeremy Allison2018-08-132-8/+51
| | | | | | | | | | | | | | | | | | | | | | | | malicious servers. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13453 CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
| * CVE-2018-10858: libsmb: Ensure smbc_urlencode() can't overwrite passed in ↵Jeremy Allison2018-08-131-2/+7
| | | | | | | | | | | | | | | | | | | | | | | | buffer. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13453 CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
| * VERSION: Bump version up to 4.6.16...Karolin Seeger2018-08-131-2/+2
| | | | | | | | | | | | | | and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger <kseeger@samba.org> (cherry picked from commit 7705a4d471a427041616a9897158474d8a5ff457)
* | VERSION: Bump version up to 4.6.16...Karolin Seeger2018-04-131-2/+2
|/ | | | | | and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger <kseeger@samba.org>
* VERSION: Disable GIT_SNAPSHOT for the 4.6.15 release.samba-4.6.15Karolin Seeger2018-04-131-1/+1
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* WHATSNEW: Add release notes for Samba 4.6.15.Karolin Seeger2018-04-131-3/+78
| | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
* torture: Test compound request request countersVolker Lendecke2018-04-121-0/+77
| | | | | | | | | | | | | | | | | | | | This will send an unfixed smbd into the SMB_ASSERT(op->request_count > 0); in smbd_smb2_request_reply_update_counts BUG: https://bugzilla.samba.org/show_bug.cgi?id=13215 Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Thu Apr 12 14:38:39 CEST 2018 on sn-devel-144 (cherry picked from commit 40edd1bc273f664d5567ef5be169033899acee1f) Autobuild-User(v4-6-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-6-test): Thu Apr 12 21:56:31 CEST 2018 on sn-devel-144
* s3:smb2_server: correctly maintain request counters for compound requestsStefan Metzmacher2018-04-121-1/+5
| | | | | | | | | | | | | | | | | | | If a session expires during a compound request chain, we exit smbd_smb2_request_dispatch() with 'return smbd_smb2_request_error(req, ...)' before calling smbd_smb2_request_dispatch_update_counts(). As req->request_counters_updated was only reset within smbd_smb2_request_dispatch_update_counts(), smbd_smb2_request_reply_update_counts() was called twice on the same request, which triggers SMB_ASSERT(op->request_count > 0); BUG: https://bugzilla.samba.org/show_bug.cgi?id=13215 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> (cherry picked from commit 87e25cd1e45bfe57292b62ffc44ddafc01c61ca0)
* s3: smbd: Unix extensions attempts to change wrong field in fchown call.Jeremy Allison2018-04-111-2/+2
| | | | | | | | | | | | | | | | | | Cut and paste error. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13375 Reported-by: Rungta, Vandana <vrungta@amazon.com> Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org> Autobuild-User(master): David Disseldorp <ddiss@samba.org> Autobuild-Date(master): Tue Apr 10 00:45:56 CEST 2018 on sn-devel-144 (cherry picked from commit 3227b110d065500ed84fc70063da70ab35823a2e) Autobuild-User(v4-6-test): Karolin Seeger <kseeger@samba.org> Autobuild-Date(v4-6-test): Wed Apr 11 16:55:21 CEST 2018 on sn-devel-144
* s3:smbd: map nterror on smb2_flush errorpathAnton Nefedov via samba-technical2018-04-111-1/+1
| | | | | | | | | | | | smbd_smb2_flush_recv() expects nterror in tevent_req, and otherwise aborts in tevent_req_is_nterror() BUG: https://bugzilla.samba.org/show_bug.cgi?id=13338 Signed-off-by: Anton Nefedov <anton.nefedov@virtuozzo.com> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> (cherry picked from commit 98623129446672521b7fa41d3457b8ce95db828c)
* vfs_glusterfs: Fix the wrong pointer being sent in glfs_fsync_asyncPoornima G2018-04-111-1/+1
| | | | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13297 Pair-Programmed-With: Anoop C S <anoopcs@redhat.com> Signed-off-by: Poornima G <pgurusid@redhat.com> Reviewed-by: Guenther Deschner <gd@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Mon Feb 26 20:17:50 CET 2018 on sn-devel-144 (cherry picked from commit 46e6626f73f42c84f254507c3ec2b591e2e732ba)
* s3: smbd: Fix possible directory fd leak if the underlying OS doesn't ↵Jeremy Allison2018-04-111-3/+6
| | | | | | | | | | | | | | | | support fdopendir() HPUX has this problem. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13270 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Autobuild-User(master): Ralph Böhme <slow@samba.org> Autobuild-Date(master): Fri Feb 23 22:56:35 CET 2018 on sn-devel-144 (cherry picked from commit 5ad5e7966f555b1d2b39d276646934a2cd2535e6)
* s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't ↵Jeremy Allison2018-04-111-0/+9
| | | | | | | | | | | | | | | | | own it here. Thanks to Isaac Boukris <iboukris@gmail.com> for finding the issue and testing this fix. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13244 Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Jan 26 02:25:20 CET 2018 on sn-devel-144 (cherry picked from commit e7425bd5245ffea68b7e8f794c9b5f864d103769)
* tests/bind.py: Add a bind test with NTLMSSP with no domainGarming Sam2018-03-201-1/+25
| | | | | | | | | | | | | | Confirmed to pass against Windows 2012 R2. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13206 Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> (cherry picked from commit 2e49a97777ebf5bffbeadca03517b4a21bca24c0) Autobuild-User(v4-6-test): Stefan Metzmacher <metze@samba.org> Autobuild-Date(v4-6-test): Tue Mar 20 21:20:00 CET 2018 on sn-devel-144
* s3:cliconnect.c: remove useless ';'Stefan Metzmacher2018-03-201-1/+1
| | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=13206 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit e039e9b0d2a16b21ace019b028e5c8244486b8a3)
* s3:libsmb: allow -U"\\administrator" to workStefan Metzmacher2018-03-201-1/+6
| | | | | | | | | | cli_credentials_get_principal() returns NULL in that case. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13206 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 0786a65cabb92a812cf1c692d0d26914f74a6f87)
* Merge tag 'samba-4.6.14' into v4-6-testStefan Metzmacher2018-03-130-0/+0
|\ | | | | | | samba: tag release samba-4.6.14
| * VERSION: Disable GIT_SNAPSHOT for the 4.6.14 release.samba-4.6.14Karolin Seeger2018-03-121-1/+1
| | | | | | | | | | | | | | CVE-2018-1050 (Denial of Service Attack on external print server.) CVE-2018-1057 (Authenticated users can change other users' password.) Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * WHATSNEW: Add release notes for Samba 4.6.14.Karolin Seeger2018-03-121-2/+78
| | | | | | | | Signed-off-by: Karolin Seeger <kseeger@samba.org>
| * CVE-2018-1057: s4:dsdb/acl: changing dBCSPwd is only allowed with a controlRalph Boehme2018-03-121-1/+10
| | | | | | | | | | | | | | | | | | | | This is not strictly needed to fig bug 13272, but it makes sense to also fix this while fixing the overall ACL checking logic. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb: use DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OIDRalph Boehme2018-03-122-4/+67
| | | | | | | | | | | | | | | | | | | | | | | | This is used to pass information about which password change operation (change or reset) the acl module validated, down to the password_hash module. It's very important that both modules treat the request identical. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/samdb: define ↵Ralph Boehme2018-03-123-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OID control Will be used to pass "user password change" vs "password reset" from the ACL to the password_hash module, ensuring both modules treat the request identical. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/acl: run password checking only onceRalph Boehme2018-03-121-0/+5
| | | | | | | | | | | | | | | | | | | | | | This is needed, because a later commit will let the acl module add a control to the change request msg and we must ensure that this is only done once. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4/dsdb: correctly detect password resetsRalph Boehme2018-03-122-3/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change ensures we correctly treat the following LDIF dn: cn=testuser,cn=users,... changetype: modify delete: userPassword add: userPassword userPassword: thatsAcomplPASS1 as a password reset. Because delete and add element counts are both one, the ACL module wrongly treated this as a password change request. For a password change we need at least one value to delete and one value to add. This patch ensures we correctly check attributes and their values. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/acl: add a NULL check for talloc_new() in ↵Ralph Boehme2018-03-121-0/+4
| | | | | | | | | | | | | | | | | | acl_check_password_rights() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/acl: add check for ↵Ralph Boehme2018-03-121-0/+20
| | | | | | | | | | | | | | | | | | DSDB_CONTROL_PASSWORD_HASH_VALUES_OID control Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/acl: check for internal controls before other checksRalph Boehme2018-03-121-14/+23
| | | | | | | | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/acl: remove unused else branches in ↵Ralph Boehme2018-03-121-2/+12
| | | | | | | | | | | | | | | | | | acl_check_password_rights() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/acl: only call dsdb_acl_debug() if we checked the acl ↵Ralph Boehme2018-03-121-0/+8
| | | | | | | | | | | | | | | | | | in acl_check_password_rights() Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/password_hash: add a helper variable for ↵Ralph Boehme2018-03-121-6/+3
| | | | | | | | | | | | | | | | | | passwordAttr->num_values Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/password_hash: add a helper variable for ↵Ralph Boehme2018-03-121-5/+9
| | | | | | | | | | | | | | | | | | LDB_FLAG_MOD_TYPE Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1057: s4:dsdb/tests: add a test for password change with empty deleteRalph Boehme2018-03-122-0/+51
| | | | | | | | | | | | | | | | | | | | Note that the request using the clearTextPassword attribute for the password change is already correctly rejected by the server. Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272 Signed-off-by: Ralph Boehme <slow@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
| * CVE-2018-1050: s3: RPC: spoolss server. Protect against null pointer derefs.Jeremy Allison2018-03-121-0/+13
| | | | | | | | | | | | BUG: https://bugzilla.samba.org/show_bug.cgi?id=11343 Signed-off-by: Jeremy Allison <jra@samba.org>
| * VERSION: Bump version up to 4.6.14...Karolin Seeger2018-03-121-2/+2
| | | | | | | | | | | | | | and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger <kseeger@samba.org> (cherry picked from commit 2ed874196b73fce0e2376f0a4237f9986413e95f)
* | VERSION: Bump version up to 4.6.15...Karolin Seeger2018-03-131-2/+2
| | | | | | | | | | | | and re-enable GIT_SNAPSHOT. Signed-off-by: Karolin Seeger <kseeger@samba.org>
View Lorry Controller Status