sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

CVE-2022-38023 s4:rpc_server/netlogon: require aes if weak crypto is disabled

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15240

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
This commit is contained in:
Stefan Metzmacher 2022-11-25 10:10:33 +01:00
parent b6339fd1dc
commit 4c7f84798a
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
source4/rpc_server/netlogon/dcerpc_netlogon.c
View File

@ -137,6 +137,15 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3_check_downgrade(
bool reject_des_client = !allow_nt4_crypto;
bool reject_md5_client = lpcfg_reject_md5_clients(lp_ctx);
/*
* If weak cryto is disabled, do not announce that we support RC4.
*/
if (lpcfg_weak_crypto(lp_ctx) == SAMBA_WEAK_CRYPTO_DISALLOWED) {
/* Without RC4 and DES we require AES */
reject_des_client = true;
reject_md5_client = true;
}
if (negotiate_flags & NETLOGON_NEG_STRONG_KEYS) {
reject_des_client = false;
}

2
source4/torture/rpc/netlogon_crypto.c
View File

@ -150,7 +150,7 @@ static bool test_ServerAuth3Crypto(struct dcerpc_pipe *p,
force_client_rc4) {
torture_assert_ntstatus_equal(tctx,
a.out.result,
NT_STATUS_ACCESS_DENIED,
NT_STATUS_DOWNGRADE_DETECTED,
"Unexpected status code");
return false;
}