diff options
| author | Stefan Metzmacher <metze@samba.org> | 2016-11-23 11:42:59 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2016-12-09 09:55:41 +0100 |
| commit | ff8a94caab2b9705ef393791140380ad70291e12 (patch) | |
| tree | 1d570b4767a128700a9cbc7579d198ecb17ea1ca | |
| parent | f609b3cda4b6b349ec7090ff6aa1dafe31ba495d (diff) | |
| download | samba-ff8a94caab2b9705ef393791140380ad70291e12.tar.gz | |
CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG
We should only use GSS_C_DELEG_POLICY_FLAG in order to let
the KDC decide if we should send delegated credentials to
a remote server.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
| -rw-r--r-- | source3/librpc/crypto/gse.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c index 963c98a9e9d..c4c4bbc8a0c 100644 --- a/source3/librpc/crypto/gse.c +++ b/source3/librpc/crypto/gse.c @@ -142,7 +142,6 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx, memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG | - GSS_C_DELEG_FLAG | GSS_C_DELEG_POLICY_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG; |