Joseph Sutton ae3b615236 CVE-2021-20251 s3: Ensure bad password count atomic updates for SAMR password change ... The bad password count is supposed to limit the number of failed login attempt a user can make before being temporarily locked out, but race conditions between processes have allowed determined attackers to make many more than the specified number of attempts. This is especially bad on constrained or overcommitted hardware. To fix this, once a bad password is detected, we reload the sam account information under a user-specific mutex, ensuring we have an up to date bad password count. Derived from a similar patch to source3/auth/check_samsec.c by Jeremy Allison <jra@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> (cherry picked from commit 65c473d4a5)		2022-09-18 16:46:09 +00:00
..
auth	CVE-2021-20251 s3: ensure bad password count atomic updates	2022-09-18 16:46:09 +00:00
build
client	s3/client: fix dfs deltree, resolve dfs path	2022-06-20 10:56:52 +00:00
exports
groupdb
include	smbd: add and use vfs_fget_dos_attributes()	2022-09-06 07:54:13 +00:00
intl
lib	vfs_aixacl: add proper header file	2022-02-27 19:08:16 +00:00
libads	s3:libads: Check if we have a valid sockaddr	2022-07-11 11:33:49 +00:00
libgpo/gpext
libnet	s3:libnet: Do not set ADS_AUTH_ALLOW_NTLMSSP in FIPS mode	2022-01-22 00:27:52 +00:00
librpc	s3:rpc_server: Delete unused code and doc references	2021-12-10 14:02:30 +00:00
libsmb	s3:libsmb: Fix errno for failed authentication in SMBC_server_internal()	2022-03-17 09:14:56 +00:00
locale	pam_winbind/ro.po: fix error from previous patch merge	2020-10-29 20:49:16 +00:00
locking	s3: smbd: Move implicit call to lp_posix_cifsu_locktype() out of init_strict_lock_struct().	2022-01-06 15:11:38 +00:00
modules	vfs_default: assert all passed in fsp's and names are non-stream type	2022-09-06 07:54:13 +00:00
nmbd	source3: move lib/substitute.c functions out of proto.h	2021-11-11 13:49:32 +00:00
param	docs-xml: add 'kdc enable fast' option	2022-03-14 14:27:13 +00:00
passdb	CVE-2022-32746 ldb: Make use of functions for appending to an ldb_message	2022-07-24 09:20:21 +02:00
printing	s3:printing: Do not clear the printer-list.tdb	2022-07-11 10:27:17 +00:00
profile	profile3: remove an unused include	2022-01-18 20:22:38 +00:00
registry	CVE-2020-25717: Add FreeIPA domain controller role	2021-11-09 19:45:33 +00:00
rpc_client	s3:rpc_client: let rpccli_netlogon_network_logon() fallback to workstation = lp_netbios_name()	2022-03-16 13:41:14 +00:00
rpc_server	CVE-2021-20251 s3: Ensure bad password count atomic updates for SAMR password change	2022-09-18 16:46:09 +00:00
rpcclient	s3:rpcclient: Goto done in cmd_samr_setuserinfo_int()	2022-07-31 19:14:59 +00:00
script	CI: add a test trying to delete a stream on a pathref ("stat open") handle	2022-09-06 07:54:13 +00:00
selftest	smbtorture: add a test trying to create a stream on share without streams support	2022-09-06 07:54:14 +00:00
services	s3:services: Disable rcinit-based service control code	2021-12-10 14:02:30 +00:00
smbd	smbd: check for streams support in unix_convert()	2022-09-06 08:49:51 +00:00
torture	smbd: use metadata_fsp() with SMB_VFS_FSET_NT_ACL()	2022-09-06 07:54:13 +00:00
utils	s3/util/py_net.c: fix samba-tool domain join&leave segfault	2022-08-08 10:32:22 +00:00
web
winbindd	s3:winbind: Use the canonical realm name to renew the credentials	2022-07-18 09:40:12 +00:00
.clang_complete
.dmallocrc
.indent.pro
Doxyfile
mainpage.dox
smbadduser.in
wscript	Revert "s3:smbd: Remove NIS support"	2022-06-12 09:19:16 +00:00
wscript_build	s3:waf: Fix version number of public libsmbconf	2022-06-27 08:25:10 +00:00
wscript_configure_system_ncurses