From: Tim Beale Date: Mon, 12 Nov 2018 23:24:16 +0000 (+1300) Subject: CVE-2018-16857 dsdb/util: Correctly treat lockOutObservationWindow as 64-bit int X-Git-Tag: tdb-1.3.17~591 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c7b937c5aae40483f2f37727758ed50877f17a5b;p=thirdparty%2Fsamba.git CVE-2018-16857 dsdb/util: Correctly treat lockOutObservationWindow as 64-bit int Commit 442a38c918ae1666b35 refactored some code into a new get_lockout_observation_window() function. However, in moving the code, an ldb_msg_find_attr_as_int64() inadvertently got converted to a ldb_msg_find_attr_as_int(). ldb_msg_find_attr_as_int() will only work for values up to -2147483648 (about 3.5 minutes in MS timestamp form). Unfortunately, the automated tests used a low enough timeout that they still worked, however, password lockout would not work with the Samba default settings. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13683 Signed-off-by: Tim Beale Reviewed-by: Andrew Bartlett --- diff --git a/selftest/knownfail.d/password_lockout b/selftest/knownfail.d/password_lockout index 305bcbdef25..a4e37a84c21 100644 --- a/selftest/knownfail.d/password_lockout +++ b/selftest/knownfail.d/password_lockout @@ -1,4 +1,2 @@ samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTestsWithDefaults.test_pso_login_lockout_krb5\(ad_dc_ntvfs\) samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTestsWithDefaults.test_pso_login_lockout_ntlm\(ad_dc_ntvfs\) -samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTestsWithDefaults.test_login_lockout_ntlm\(ad_dc_ntvfs\) -samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTestsWithDefaults.test_login_lockout_krb5\(ad_dc_ntvfs\) diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c index 7ce5168c6c7..dcbfc8c60a3 100644 --- a/source4/dsdb/common/util.c +++ b/source4/dsdb/common/util.c @@ -5407,12 +5407,12 @@ static int64_t get_lockout_observation_window(struct ldb_message *domain_msg, struct ldb_message *pso_msg) { if (pso_msg != NULL) { - return ldb_msg_find_attr_as_int(pso_msg, - "msDS-LockoutObservationWindow", - 0); + return ldb_msg_find_attr_as_int64(pso_msg, + "msDS-LockoutObservationWindow", + 0); } else { - return ldb_msg_find_attr_as_int(domain_msg, - "lockOutObservationWindow", 0); + return ldb_msg_find_attr_as_int64(domain_msg, + "lockOutObservationWindow", 0); } }