From bdfc9d96f8fe5070ab8a189bbf42ccb7e77afb73 Mon Sep 17 00:00:00 2001 From: Joseph Sutton Date: Sat, 9 Jul 2022 15:54:52 +1200 Subject: [PATCH] CVE-2021-20251 s4:kdc: Check badPwdCount update return status If the account has been locked out in the meantime (indicated by NT_STATUS_ACCOUNT_LOCKED_OUT), we should return the appropriate error code. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611 Signed-off-by: Joseph Sutton Reviewed-by: Andreas Schneider Reviewed-by: Andrew Bartlett --- selftest/knownfail_heimdal_kdc | 4 ---- source4/kdc/hdb-samba4.c | 9 +++++++-- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc index 8d3e4fd564c..99f687e3212 100644 --- a/selftest/knownfail_heimdal_kdc +++ b/selftest/knownfail_heimdal_kdc @@ -142,7 +142,3 @@ ^samba.tests.krb5.claims_tests.samba.tests.krb5.claims_tests.ClaimsTests.test_tgs_claims_remove_claims.ad_dc ^samba.tests.krb5.claims_tests.samba.tests.krb5.claims_tests.ClaimsTests.test_tgs_claims_remove_claims_to_krbtgt.ad_dc ^samba.tests.krb5.claims_tests.samba.tests.krb5.claims_tests.ClaimsTests.test_tgs_claims_to_krbtgt.ad_dc -# -# Lockout tests -# -^samba.tests.krb5.lockout_tests.samba.tests.krb5.lockout_tests.LockoutTests.test_lockout_race_kdc.ad_dc:local diff --git a/source4/kdc/hdb-samba4.c b/source4/kdc/hdb-samba4.c index b17ef6aaf6a..699ef9a577c 100644 --- a/source4/kdc/hdb-samba4.c +++ b/source4/kdc/hdb-samba4.c @@ -706,8 +706,13 @@ static krb5_error_code hdb_samba4_audit(krb5_context context, } else if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_TIME_SKEW) { status = NT_STATUS_TIME_DIFFERENCE_AT_DC; } else if (hdb_auth_status == KDC_AUTH_EVENT_WRONG_LONG_TERM_KEY) { - authsam_update_bad_pwd_count(kdc_db_ctx->samdb, p->msg, domain_dn); - status = NT_STATUS_WRONG_PASSWORD; + status = authsam_update_bad_pwd_count(kdc_db_ctx->samdb, p->msg, domain_dn); + if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) { + final_ret = KRB5KDC_ERR_CLIENT_REVOKED; + r->error_code = final_ret; + } else { + status = NT_STATUS_WRONG_PASSWORD; + } rwdc_fallback = kdc_db_ctx->rodc; } else if (hdb_auth_status == KDC_AUTH_EVENT_CLIENT_LOCKED_OUT) { status = NT_STATUS_ACCOUNT_LOCKED_OUT; -- 2.47.3