CVE-2021-3738 s4:rpc_server/samr: make use of dcesrv_samdb_connect_as_*() helper
authorStefan Metzmacher <metze@samba.org>
Thu, 5 Aug 2021 12:24:40 +0000 (14:24 +0200)
committerJule Anger <janger@samba.org>
Mon, 8 Nov 2021 09:52:13 +0000 (10:52 +0100)
commit0203330e2fa23482d99809e777ccb8a93a728aa3
treee13dc7f176f3b0de762b37a360a52ab4d9ad6e36
parent08b6c8fda591c129adecd0779bf4a62386b8c740
CVE-2021-3738 s4:rpc_server/samr: make use of dcesrv_samdb_connect_as_*() helper

This avoids a crash that's triggered by windows clients using
handles from samr_Connect*() on across multiple connections within
an association group.

In other cases is not strictly required, but it makes it easier to audit that
source4/rpc_server no longer calls samdb_connect() directly and also
improves the auditing for the dcesrv_samdb_connect_as_system() case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14468

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org Backported from master as Samba 4.13 does not
 call dcerpc_is_transport_encrypted() and so session_info becomes
 unused.]
source4/rpc_server/samr/dcesrv_samr.c
source4/rpc_server/samr/samr_password.c