diff options
| author | Stefan Metzmacher <metze@samba.org> | 2016-11-23 11:41:10 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2016-12-19 10:52:16 +0100 |
| commit | 205ec587d5ce361ff8967fe8feda8d973e8b8730 (patch) | |
| tree | 556a8177a82c51932e82978de1e8846fb2a7c1c8 | |
| parent | bf86df5b921492d8c0f61e269af3887d3051caf4 (diff) | |
| download | samba-205ec587d5ce361ff8967fe8feda8d973e8b8730.tar.gz | |
CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss
This is just an example script that's not directly used by samba,
but we should avoid sending delegated credentials to dns servers.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
| -rwxr-xr-x | source4/scripting/bin/nsupdate-gss | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source4/scripting/bin/nsupdate-gss b/source4/scripting/bin/nsupdate-gss index dec5916f286..509220d5a1d 100755 --- a/source4/scripting/bin/nsupdate-gss +++ b/source4/scripting/bin/nsupdate-gss @@ -178,7 +178,7 @@ sub negotiate_tkey($$$$) my $flags = GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG | - GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG; + GSS_C_INTEG_FLAG; $status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE, |