samba-mirror

mirror of https://github.com/samba-team/samba.git synced 2025-02-25 17:57:42 +03:00

History

Ralph Boehme 8f79ee99a6 CVE-2020-25717: s3:auth: remove fallbacks in smb_getpwnam()

So far we tried getpwnam("DOMAIN\account") first and
always did a fallback to getpwnam("account") completely
ignoring the domain part, this just causes problems
as we mix "DOMAIN1\account", "DOMAIN2\account",
and "account"!

As we require a running winbindd for domain member setups
we should no longer do a fallback to just "account" for
users served by winbindd!

For users of the local SAM don't use this code path,
as check_sam_security() doesn't call check_account().

The only case where smb_getpwnam("account") happens is
when map_username() via ("username map [script]")  mapped
"DOMAIN\account" to something without '\', but that is
explicitly desired by the admin.

Note: use 'git show -w'

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Ralph Boehme <slow@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

2021-11-09 19:45:33 +00:00

auth_builtin.c

s3: safe_string: do not include string_wrappers.h

2020-08-28 00:56:34 +00:00

auth_generic.c

CVE-2020-25717: s3:auth: let auth3_generate_session_info_pac() forward the low level errors

2021-11-09 19:45:33 +00:00

auth_ntlmssp.c

auth3: Fix a typo

2021-04-27 13:24:35 +00:00

auth_sam.c

auth_sam: use pdb_get_domain_info to look up DNS forest information