54 lines
2.2 KiB
Diff
54 lines
2.2 KiB
Diff
From 3e7bdcd0e488fe0788ca537ca9894f0c4fda6be6 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Bartlett <abartlet@samba.org>
|
|
Date: Mon, 7 Aug 2023 11:56:56 +1200
|
|
Subject: [PATCH 20/28] CVE-2023-4154 dsdb/tests: Check that secret attributes
|
|
are not visible with DirSync ever.
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15424
|
|
|
|
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
|
Conflict: NA
|
|
Reference: https://download.samba.org/pub/samba/patches/security/samba-4.18.8-security-2023-10-10.patch
|
|
[PATCH 20/28] CVE-2023-4154 dsdb/tests: Check that secret attributes
|
|
are not visible with DirSync ever.
|
|
---
|
|
selftest/knownfail.d/dirsync | 1 +
|
|
source4/dsdb/tests/python/dirsync.py | 12 ++++++++++++
|
|
2 files changed, 13 insertions(+)
|
|
create mode 100644 selftest/knownfail.d/dirsync
|
|
|
|
diff --git a/selftest/knownfail.d/dirsync b/selftest/knownfail.d/dirsync
|
|
new file mode 100644
|
|
index 00000000000..9367f92e109
|
|
--- /dev/null
|
|
+++ b/selftest/knownfail.d/dirsync
|
|
@@ -0,0 +1 @@
|
|
+^samba4.ldap.dirsync.python\(.*\).__main__.SimpleDirsyncTests.test_dirsync_unicodePwd
|
|
\ No newline at end of file
|
|
diff --git a/source4/dsdb/tests/python/dirsync.py b/source4/dsdb/tests/python/dirsync.py
|
|
index e06b85bc749..2cacaf01251 100755
|
|
--- a/source4/dsdb/tests/python/dirsync.py
|
|
+++ b/source4/dsdb/tests/python/dirsync.py
|
|
@@ -742,6 +742,18 @@ class SimpleDirsyncTests(DirsyncBaseTests):
|
|
self.assertEqual(guid2, guid)
|
|
self.assertEqual(str(res[0].dn), "")
|
|
|
|
+ def test_dirsync_unicodePwd(self):
|
|
+ res = self.ldb_admin.search(self.base_dn,
|
|
+ attrs=["unicodePwd", "supplementalCredentials", "samAccountName"],
|
|
+ expression="(samAccountName=krbtgt)",
|
|
+ controls=["dirsync:1:0:0"])
|
|
+
|
|
+ self.assertTrue(len(res) == 1)
|
|
+ # This form ensures this is a case insensitive comparison
|
|
+ self.assertTrue("samAccountName" in res[0])
|
|
+ self.assertTrue(res[0].get("samAccountName"))
|
|
+ self.assertTrue(res[0].get("unicodePwd") is None)
|
|
+ self.assertTrue(res[0].get("supplementalCredentials") is None)
|
|
|
|
if not getattr(opts, "listtests", False):
|
|
lp = sambaopts.get_loadparm()
|
|
--
|
|
2.34.1
|