sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-25 17:57:42 +03:00
Code

CVE-2023-0225 s4-acl: Don't return early if dNSHostName element has no values

Browse Source 
This early return would mistakenly allow an unprivileged user to delete
the dNSHostName attribute by making an LDAP modify request with no
values. We should no longer allow this.

Add or replace operations with no values and no privileges are
disallowed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15276

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Joseph Sutton 2023-01-09 11:22:34 +13:00 committed by Jule Anger
parent 54691236fc
commit 888c6ae817
2 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
selftest/knownfail.d/dns-host-name-deletion
View File

@ -1,2 +0,0 @@
^samba4.ldap.acl_modify.python\(.*\).__main__.AclModifyTests.test_modify_delete_dns_host_name_ldif_unspecified\(.*\)
^samba4.ldap.acl_modify.python\(.*\).__main__.AclModifyTests.test_modify_delete_dns_host_name_unspecified\(.*\)

12
source4/dsdb/samdb/ldb_modules/acl.c
View File

@ -798,11 +798,6 @@ static int acl_check_dns_host_name(TALLOC_CTX *mem_ctx,
NULL
};
if (el->num_values == 0) {
return LDB_SUCCESS;
}
dnsHostName = &el->values[0];
tmp_ctx = talloc_new(mem_ctx);
if (tmp_ctx == NULL) {
return ldb_oom(ldb);
@ -948,6 +943,13 @@ static int acl_check_dns_host_name(TALLOC_CTX *mem_ctx,
--account_name_len;
}
/* Check for add or replace requests with no value. */
if (el->num_values == 0) {
talloc_free(tmp_ctx);
return ldb_operr(ldb);
}
dnsHostName = &el->values[0];
dnsHostName_str = (const char *)dnsHostName->data;
dns_host_name_len = dnsHostName->length;