diff options
| author | Stefan Metzmacher <metze@samba.org> | 2016-11-23 11:41:10 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2016-12-09 12:05:00 +0100 |
| commit | b83897ae49fdee1fda73c10c7fe73362bfaba690 (patch) | |
| tree | 556a8177a82c51932e82978de1e8846fb2a7c1c8 | |
| parent | 9d65af0137f793530e3cb1786b22bd803fd6dd19 (diff) | |
| download | samba-b83897ae49fdee1fda73c10c7fe73362bfaba690.tar.gz | |
CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss
This is just an example script that's not directly used by samba,
but we should avoid sending delegated credentials to dns servers.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
| -rwxr-xr-x | source4/scripting/bin/nsupdate-gss | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source4/scripting/bin/nsupdate-gss b/source4/scripting/bin/nsupdate-gss index dec5916f286..509220d5a1d 100755 --- a/source4/scripting/bin/nsupdate-gss +++ b/source4/scripting/bin/nsupdate-gss @@ -178,7 +178,7 @@ sub negotiate_tkey($$$$) my $flags = GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG | - GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG; + GSS_C_INTEG_FLAG; $status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE, |