sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-24 02:04:21 +03:00
Code

CVE-2023-4154 dsdb/tests: Check that secret attributes are not visible with DirSync ever.

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Andrew Bartlett 2023-08-07 11:56:56 +12:00 committed by Jule Anger
parent 23031057e8
commit 3e7bdcd0e4
2 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail.d/dirsync Normal file
View File

@ -0,0 +1 @@
^samba4.ldap.dirsync.python\(.*\).__main__.SimpleDirsyncTests.test_dirsync_unicodePwd

12
source4/dsdb/tests/python/dirsync.py
View File

@ -742,6 +742,18 @@ class SimpleDirsyncTests(DirsyncBaseTests):
self.assertEqual(guid2, guid) self.assertEqual(guid2, guid)
self.assertEqual(str(res[0].dn), "") self.assertEqual(str(res[0].dn), "")
def test_dirsync_unicodePwd(self):
res = self.ldb_admin.search(self.base_dn,
attrs=["unicodePwd", "supplementalCredentials", "samAccountName"],
expression="(samAccountName=krbtgt)",
controls=["dirsync:1:0:0"])
self.assertTrue(len(res) == 1)
# This form ensures this is a case insensitive comparison
self.assertTrue("samAccountName" in res[0])
self.assertTrue(res[0].get("samAccountName"))
self.assertTrue(res[0].get("unicodePwd") is None)
self.assertTrue(res[0].get("supplementalCredentials") is None)
if not getattr(opts, "listtests", False): if not getattr(opts, "listtests", False):
lp = sambaopts.get_loadparm() lp = sambaopts.get_loadparm()