sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-12 20:58:37 +03:00
Code

CVE-2020-25717: s3:auth: Check minimum domain uid

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

[abartlet@samba.org Removed knownfail on advice from metze]
This commit is contained in:
Samuel Cabrero 2021-09-28 10:45:11 +02:00 committed by Jule Anger
parent c703f7a564
commit ce47a81eb5
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail.d/min_domain_uid
View File

@ -1 +0,0 @@
^samba.tests.krb5.test_min_domain_uid.samba.*.SmbMinDomainUid.test_min_domain_uid_.*\(ad_member_no_nss_wb:local\)

16
source3/auth/auth_util.c
View File

@ -2103,6 +2103,22 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
}
}
goto out;
} else if ((lp_security() == SEC_ADS || lp_security() == SEC_DOMAIN) &&
!is_myname(domain) && pwd->pw_uid < lp_min_domain_uid()) {
/*
* !is_myname(domain) because when smbd starts tries to setup
* the guest user info, calling this function with nobody
* username. Nobody is usually uid 65535 but it can be changed
* to a regular user with 'guest account' parameter
*/
nt_status = NT_STATUS_INVALID_TOKEN;
DBG_NOTICE("Username '%s%s%s' is invalid on this system, "
"it does not meet 'min domain uid' "
"restriction (%u < %u): %s\n",
nt_domain, lp_winbind_separator(), nt_username,
pwd->pw_uid, lp_min_domain_uid(),
nt_errstr(nt_status));
goto out;
}
result = make_server_info(tmp_ctx);