CVE-2020-25718 s4-rpc_server: Put msDS-KrbTgtLinkBL and UF_INTERDOMAIN_TRUST_ACCOUNT...

While these checks were not in the NETLOGON case, there is no sense where
an RODC should be resetting a bad password count on either a
UF_INTERDOMAIN_TRUST_ACCOUNT nor a RODC krbtgt account.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>

diff --git a/source4/rpc_server/common/sid_helper.c b/source4/rpc_server/common/sid_helper.c
index eaeab236fc0111d41ef6c67db685d012df387e7f..ab2b4373b4734ad8b526a7d77913e4c8b98ed006 100644 (file)
--- a/source4/rpc_server/common/sid_helper.c
+++ b/source4/rpc_server/common/sid_helper.c
@@ -133,16 +133,37 @@ WERROR samdb_result_sid_array_dn(struct ldb_context *sam_ctx,
 
 WERROR samdb_confirm_rodc_allowed_to_repl_to_sid_list(struct ldb_context *sam_ctx,
                                                      struct ldb_message *rodc_msg,
+                                                     struct ldb_message *obj_msg,
                                                      uint32_t num_token_sids,
                                                      struct dom_sid *token_sids)
 {
        uint32_t num_never_reveal_sids, num_reveal_sids;
        struct dom_sid *never_reveal_sids, *reveal_sids;
        TALLOC_CTX *frame = talloc_stackframe();
-       WERROR werr = samdb_result_sid_array_dn(sam_ctx, rodc_msg,
-                                               frame, "msDS-NeverRevealGroup",
-                                               &num_never_reveal_sids,
-                                               &never_reveal_sids);
+       WERROR werr;
+       
+       /*
+        * We are not allowed to get anyone elses krbtgt secrets (and
+        * in callers that don't shortcut before this, the RODC should
+        * not deal with any krbtgt)
+        */
+       if (samdb_result_dn(sam_ctx, frame,
+                           obj_msg, "msDS-KrbTgtLinkBL", NULL)) {
+               TALLOC_FREE(frame);
+               return WERR_DS_DRA_SECRETS_DENIED;
+       }
+
+       if (ldb_msg_find_attr_as_uint(obj_msg,
+                                     "userAccountControl", 0) &
+           UF_INTERDOMAIN_TRUST_ACCOUNT) {
+               TALLOC_FREE(frame);
+               return WERR_DS_DRA_SECRETS_DENIED;
+       }
+
+       werr = samdb_result_sid_array_dn(sam_ctx, rodc_msg,
+                                        frame, "msDS-NeverRevealGroup",
+                                        &num_never_reveal_sids,
+                                        &never_reveal_sids);
        if (!W_ERROR_IS_OK(werr)) {
                TALLOC_FREE(frame);
                return WERR_DS_DRA_SECRETS_DENIED;

diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
index 3b1d674573ff9ae71bdad86853d9d76724cda174..a9d305fc9a058b4238c38d3263b25f46e6886918 100644 (file)
--- a/source4/rpc_server/drsuapi/getncchanges.c
+++ b/source4/rpc_server/drsuapi/getncchanges.c
@@ -1296,20 +1296,9 @@ static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
                goto denied;
        }
 
-       /* but it isn't allowed to get anyone elses krbtgt secrets */
-       if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
-                           obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
-               goto denied;
-       }
-
-       if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
-                                     "userAccountControl", 0) &
-           UF_INTERDOMAIN_TRUST_ACCOUNT) {
-               goto denied;
-       }
-
        werr = samdb_confirm_rodc_allowed_to_repl_to_sid_list(b_state->sam_ctx_system,
                                                              rodc_res->msgs[0],
+                                                             obj_res->msgs[0],
                                                              num_token_sids,
                                                              token_sids);
 

diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 4d8fd0c4b8e8bf4bdb52cf62935e63ec7664054b..0b8330b9f2182b8051fc800182024af0a6e62c1b 100644 (file)
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -2894,6 +2894,7 @@ static bool sam_rodc_access_check(struct ldb_context *sam_ctx,
 
        werr = samdb_confirm_rodc_allowed_to_repl_to_sid_list(sam_ctx,
                                                              rodc_res->msgs[0],
+                                                             obj_res->msgs[0],
                                                              num_token_sids,
                                                              token_sids);