sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-14 01:57:53 +03:00
Code

CVE-2022-37966 s4:libnet: allow python bindings to force setting an nthash via SAMR level 18

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 4ebbe7e40754eeb1c8f221dd59018c3e681ab2ab)
This commit is contained in:
Stefan Metzmacher 2022-11-29 15:45:56 +01:00
parent 9c106afa80
commit bf633c5811
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
source4/libnet/py_net.c
View File

@ -244,20 +244,32 @@ static PyObject *py_net_set_password(py_net_Object *self, PyObject *args, PyObje
NTSTATUS status; NTSTATUS status;
TALLOC_CTX *mem_ctx; TALLOC_CTX *mem_ctx;
struct tevent_context *ev; struct tevent_context *ev;
const char *kwnames[] = { "account_name", "domain_name", "newpassword", NULL }; const char *kwnames[] = { "account_name", "domain_name", "newpassword", "force_samr_18", NULL };
PyObject *py_force_samr_18 = Py_False;
ZERO_STRUCT(r); ZERO_STRUCT(r);
r.generic.level = LIBNET_SET_PASSWORD_GENERIC; r.generic.level = LIBNET_SET_PASSWORD_GENERIC;
if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sss:set_password", if (!PyArg_ParseTupleAndKeywords(args, kwargs, "sss|O:set_password",
discard_const_p(char *, kwnames), discard_const_p(char *, kwnames),
&r.generic.in.account_name, &r.generic.in.account_name,
&r.generic.in.domain_name, &r.generic.in.domain_name,
&r.generic.in.newpassword)) { &r.generic.in.newpassword,
&py_force_samr_18)) {
return NULL; return NULL;
} }
if (py_force_samr_18) {
if (!PyBool_Check(py_force_samr_18)) {
PyErr_SetString(PyExc_TypeError, "Expected boolean force_samr_18");
return NULL;
}
if (py_force_samr_18 == Py_True) {
r.generic.samr_level = LIBNET_SET_PASSWORD_SAMR_HANDLE_18;
}
}
/* FIXME: we really need to get a context from the caller or we may end /* FIXME: we really need to get a context from the caller or we may end
* up with 2 event contexts */ * up with 2 event contexts */
ev = s4_event_context_init(NULL); ev = s4_event_context_init(NULL);