Attachment 12772 Details for Bug 12445 – CVE-2016-2125-v3.6.asn03.patch

[patch] CVE-2016-2125-v3.6.asn03.patch

CVE-2016-2125-v3.6.asn03.patch (text/plain), 1.69 KB, created by Andreas Schneider on 2016-12-16 13:21:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Schneider

Created: 2016-12-16 13:21:43 UTC

Size: 1.69 KB

patch

obsolete

>From 7cc3b25f4bf9e89e326d04b83bc7365f3cc29265 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Wed, 7 Dec 2016 10:58:35 +0100
>Subject: [PATCH] CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG
>
>We should only use GSS_C_DELEG_POLICY_FLAG in order to let
>the KDC decide if we should send delegated credentials to
>a remote server.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Backported-by: Andreas Schneider <asn@samba.org>
>---
> source3/librpc/crypto/gse.c | 1 -
> source3/libsmb/clifsinfo.c  | 2 +-
> 2 files changed, 1 insertion(+), 2 deletions(-)
>
>diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
>index 02fb0f6141d..211ca7774be 100644
>--- a/source3/librpc/crypto/gse.c
>+++ b/source3/librpc/crypto/gse.c
>@@ -162,7 +162,6 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
> 	memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
> 
> 	gse_ctx->gss_c_flags = GSS_C_MUTUAL_FLAG |
>-				GSS_C_DELEG_FLAG |
> 				GSS_C_DELEG_POLICY_FLAG |
> 				GSS_C_REPLAY_FLAG |
> 				GSS_C_SEQUENCE_FLAG;
>diff --git a/source3/libsmb/clifsinfo.c b/source3/libsmb/clifsinfo.c
>index 1d66eb4c6b8..34ebc208db0 100644
>--- a/source3/libsmb/clifsinfo.c
>+++ b/source3/libsmb/clifsinfo.c
>@@ -726,7 +726,7 @@ static NTSTATUS make_cli_gss_blob(TALLOC_CTX *ctx,
> 				&es->s.gss_state->gss_ctx,
> 				srv_name,
> 				GSS_C_NO_OID, /* default OID. */
>-				GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_FLAG,
>+				GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_DELEG_POLICY_FLAG,
> 				GSS_C_INDEFINITE,	/* requested ticket lifetime. */
> 				NULL,   /* no channel bindings */
> 				p_tok_in,
>-- 
>2.11.0
>

Flags:

metze: review+

Actions: View

Attachments on bug 12445: 12707 | 12708 | 12709 | 12710 | 12711 | 12730 | 12732 | 12733 | 12735 | 12736 | 12737 | 12739 | 12766 | 12772