Joseph Sutton 65c473d4a5 CVE-2021-20251 s3: Ensure bad password count atomic updates for SAMR password change ... The bad password count is supposed to limit the number of failed login attempt a user can make before being temporarily locked out, but race conditions between processes have allowed determined attackers to make many more than the specified number of attempts. This is especially bad on constrained or overcommitted hardware. To fix this, once a bad password is detected, we reload the sam account information under a user-specific mutex, ensuring we have an up to date bad password count. Derived from a similar patch to source3/auth/check_samsec.c by Jeremy Allison <jra@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>		2022-09-12 23:07:38 +00:00
..
srv_samr_chgpasswd.c	CVE-2021-20251 s3: Ensure bad password count atomic updates for SAMR password change	2022-09-12 23:07:38 +00:00
srv_samr_nt.c	s3:rpc_server: Fix typo in error message	2022-09-12 23:07:37 +00:00
srv_samr_util.c	s3:rpc_server: Implement SAMR SetUserInfo(2) level 32	2022-07-28 11:51:29 +00:00
srv_samr_util.h	s3:rpc_server: Implement dcesrv_samr_ChangePasswordUser4()	2022-07-28 11:51:29 +00:00