[Pkg-samba-maint] [samba] 18/26: CVE-2012-6150: Fail authentication for single group name which cannot be converted to sid

[Ivo De Decker]

This is an automated email from the git hooks/post-receive script.

idd-guest pushed a commit to branch samba_4.1
in repository samba.

commit b89e14d3c7a2dc3a47d2ffdc8b3412dde6186f1e
Author: Noel Power <noel.power at suse.com>
Date:   Wed Oct 16 16:30:55 2013 +0100

    CVE-2012-6150: Fail authentication for single group name which cannot be converted to sid
    
    furthermore if more than one name is supplied and no sid is converted
    then also fail.
    
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10300
    Bug: https://bugzilla.samba.org/show_bug.cgi?id=10306
    
    Signed-off-by: Noel Power <noel.power at suse.com>
    Reviewed-by: Andreas Schneider <asn at samba.org>
    Reviewed-by: David Disseldorp <ddiss at samba.org>
    [ddiss at samba.org: fixed incorrect bugzilla tag I added to master commit]
---
 nsswitch/pam_winbind.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c
index 9f85556..98cf97e 100644
--- a/nsswitch/pam_winbind.c
+++ b/nsswitch/pam_winbind.c
@@ -1163,6 +1163,12 @@ static bool winbind_name_list_to_sid_string_list(struct pwb_context *ctx,
 		_make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s "
 				"to sid, please contact your administrator to see "
 				"if group %s is valid."), search_location, search_location);
+
+		/* If no valid groups were converted we should fail outright */
+		if (name_list != NULL && strlen(sid_list_buffer) == 0) {
+			result = false;
+			goto out;
+		}
 		/*
 		 * The lookup of the last name failed..
 		 * It results in require_member_of_sid ends with ','

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-samba/samba.git