diff options
| author | Stefan Metzmacher <metze@samba.org> | 2016-11-23 11:41:10 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2016-12-09 09:55:41 +0100 |
| commit | f609b3cda4b6b349ec7090ff6aa1dafe31ba495d (patch) | |
| tree | 80909629e17d1fbd1b2bfa7294a1a1052e632982 | |
| parent | c455677d43fbda512f0178a244c90591de481d51 (diff) | |
| download | samba-f609b3cda4b6b349ec7090ff6aa1dafe31ba495d.tar.gz | |
CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss
This is just an example script that's not directly used by samba,
but we should avoid sending delegated credentials to dns servers.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
| -rwxr-xr-x | source4/scripting/bin/nsupdate-gss | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source4/scripting/bin/nsupdate-gss b/source4/scripting/bin/nsupdate-gss index dec5916f286..509220d5a1d 100755 --- a/source4/scripting/bin/nsupdate-gss +++ b/source4/scripting/bin/nsupdate-gss @@ -178,7 +178,7 @@ sub negotiate_tkey($$$$) my $flags = GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG | - GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG; + GSS_C_INTEG_FLAG; $status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE, |