CVE-2018-1057: s4:dsdb/acl: run password checking only once

This is needed, because a later commit will let the acl module add a
control to the change request msg and we must ensure that this is only
done once.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13272

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source4/dsdb/samdb/ldb_modules/acl.c b/source4/dsdb/samdb/ldb_modules/acl.c
index d27ec80461ebf0f988dadf4c9554f95068eca860..f22592615880a204a5853ac84d7a9d8588f68343 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/acl.c
+++ b/source4/dsdb/samdb/ldb_modules/acl.c
@@ -1122,6 +1122,7 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req)
        struct ldb_control *as_system;
        struct ldb_control *is_undelete;
        bool userPassword;
+       bool password_rights_checked = false;
        TALLOC_CTX *tmp_ctx;
        const struct ldb_message *msg = req->op.mod.message;
        static const char *acl_attrs[] = {
@@ -1267,6 +1268,9 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req)
                } else if (ldb_attr_cmp("unicodePwd", el->name) == 0 ||
                           (userPassword && ldb_attr_cmp("userPassword", el->name) == 0) ||
                           ldb_attr_cmp("clearTextPassword", el->name) == 0) {
+                       if (password_rights_checked) {
+                               continue;
+                       }
                        ret = acl_check_password_rights(tmp_ctx,
                                                        module,
                                                        req,
@@ -1277,6 +1281,7 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req)
                        if (ret != LDB_SUCCESS) {
                                goto fail;
                        }
+                       password_rights_checked = true;
                } else if (ldb_attr_cmp("servicePrincipalName", el->name) == 0) {
                        ret = acl_check_spn(tmp_ctx,
                                            module,