CVE-2020-25722 samdb: Fill in isCriticalSystemObject on any account type change

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14753

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/selftest/knownfail.d/sam-isCriticalSystemObject b/selftest/knownfail.d/sam-isCriticalSystemObject
deleted file mode 100644 (file)
index a6351a8..0000000
--- a/selftest/knownfail.d/sam-isCriticalSystemObject
+++ /dev/null
@@ -1 +0,0 @@
-^samba4.sam.python\(.*\).__main__.SamTests.test_isCriticalSystemObject_user
\ No newline at end of file

diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index e947f78881020873bf799be4942ff6ed91b1bc5f..140cc22cc53d28705ea846edbe39b01ec5e3a517 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -2626,8 +2626,14 @@ static int samldb_user_account_control_change(struct samldb_ctx *ac)
                el->flags = LDB_FLAG_MOD_REPLACE;
        }
 
-       /* "isCriticalSystemObject" might be set/changed */
-       if (old_is_critical != new_is_critical) {
+       /*
+        * "isCriticalSystemObject" might be set/changed
+        *
+        * Even a change from UF_NORMAL_ACCOUNT (implicitly FALSE) to
+        * UF_WORKSTATION_TRUST_ACCOUNT (actually FALSE) triggers
+        * creating the attribute.
+        */
+       if (old_is_critical != new_is_critical || old_atype != new_atype) {
                ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
                                         new_is_critical ? "TRUE": "FALSE");
                if (ret != LDB_SUCCESS) {