sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

CVE-2018-16857 dsdb/util: Add better default lockOutObservationWindow

Browse Source 
Clearly the lockOutObservationWindow value is important, and using a
default value of zero doesn't work very well.

This patch adds a better default value (the domain default setting of 30
minutes).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Wed Nov 28 11:31:14 CET 2018 on sn-devel-144
This commit is contained in:
Tim Beale 2018-11-13 13:22:41 +13:00 committed by Karolin Seeger
parent 13014aea13
commit fde9f7c81b
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
source4/dsdb/common/util.c
View File

@ -56,6 +56,9 @@
*/ */
#include "dsdb/samdb/ldb_modules/util.h" #include "dsdb/samdb/ldb_modules/util.h"
/* default is 30 minutes: -1e7 * 30 * 60 */
#define DEFAULT_OBSERVATION_WINDOW -18000000000
/* /*
search the sam for the specified attributes in a specific domain, filter on search the sam for the specified attributes in a specific domain, filter on
objectSid being in domain_sid. objectSid being in domain_sid.
@ -5370,7 +5373,7 @@ int samdb_result_effective_badPwdCount(struct ldb_context *sam_ldb,
lockOutObservationWindow = lockOutObservationWindow =
ldb_msg_find_attr_as_int64(res->msgs[0], ldb_msg_find_attr_as_int64(res->msgs[0],
"msDS-LockoutObservationWindow", "msDS-LockoutObservationWindow",
0); DEFAULT_OBSERVATION_WINDOW);
talloc_free(res); talloc_free(res);
} else { } else {
@ -5409,10 +5412,11 @@ static int64_t get_lockout_observation_window(struct ldb_message *domain_msg,
if (pso_msg != NULL) { if (pso_msg != NULL) {
return ldb_msg_find_attr_as_int64(pso_msg, return ldb_msg_find_attr_as_int64(pso_msg,
"msDS-LockoutObservationWindow", "msDS-LockoutObservationWindow",
0); DEFAULT_OBSERVATION_WINDOW);
} else { } else {
return ldb_msg_find_attr_as_int64(domain_msg, return ldb_msg_find_attr_as_int64(domain_msg,
"lockOutObservationWindow", 0); "lockOutObservationWindow",
DEFAULT_OBSERVATION_WINDOW);
} }
} }