samba.git/source4/auth/ntlm, branch talloc-2.4.0

CVE-2021-20251: s4:auth: fix use after free in authsam_logon_success_accounting()

2022-11-24T11:01:37+00:00

This fixes a use after free problem introduced by
commit 7b8e32efc336fb728e0c7e3dd6fbe2ed54122124,
which has msg = current; which means the lifetime
of the 'msg' memory is no longer in the scope of th
caller.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15253

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4-auth: Add missing newlines to log messages

2022-10-05T04:23:32+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

CVE-2021-20251 s4:auth_winbind: Check return status of authsam_logon_success_accounting()

2022-09-12T23:07:38+00:00

This may return an error if we find the account is locked out.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611

Signed-off-by: Joseph Sutton 
Reviewed-by: Andreas Schneider 
Reviewed-by: Andrew Bartlett

CVE-2021-20251 s4-auth: Pass through error code from badPwdCount update

2022-09-12T23:07:37+00:00

The error code may be NT_STATUS_ACCOUNT_LOCKED_OUT, which we use in
preference to NT_STATUS_WRONG_PASSWORD.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14611

Signed-off-by: Joseph Sutton 
Reviewed-by: Andreas Schneider 
Reviewed-by: Andrew Bartlett

CVE-2022-2031 auth: Add ticket type field to auth_user_info_dc and auth_session_info

2022-07-27T10:52:36+00:00

This field may be used to convey whether we were provided with a TGT or
a non-TGT. We ensure both structures are zeroed out to avoid incorrect
results being produced by an uninitialised field.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049

Signed-off-by: Joseph Sutton 
Reviewed-by: Andreas Schneider

s4-auth: For LDAP simple bind, fall back to checking the ENCTYPE_AES256_CTS_HMAC_SHA1_96 if stored

2022-06-26T22:10:29+00:00

Since we don't store a salt per-key, but only a single salt, when we do
not have the NT hash in the unicodePwd (eg ntlm auth = disabled), the check
will fail for a previous password if the account was renamed prior to a
newer password being set.

Pair-Programmed-With: Stefan Metzmacher 

Signed-off-by: Andrew Bartlett 
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Stefan Metzmacher

dsdb/common: Make some parameters const

2022-06-14T07:21:29+00:00

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett 
Reviewed-by: Andreas Schneider

lib/util: Change function to mem_equal_const_time()

2022-06-09T22:49:29+00:00

Since memcmp_const_time() doesn't act as an exact replacement for
memcmp(), and its return value is only ever compared with zero, simplify
it and emphasize the intention of checking equality by returning a bool
instead.

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

auth: Use constant-time memcmp when comparing sensitive buffers

2022-06-09T22:49:29+00:00

This helps to avoid timing attacks.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15010

Signed-off-by: Joseph Sutton 
Reviewed-by: Andrew Bartlett

s4-auth: Remove last traces of LanMan authentiation support in the AD DC.

2022-03-29T03:32:57+00:00

Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher 

Autobuild-User(master): Andrew Bartlett 
Autobuild-Date(master): Tue Mar 29 03:32:57 UTC 2022 on sn-devel-184