diff options
| author | Stefan Metzmacher <metze@samba.org> | 2016-11-23 11:42:59 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2016-12-09 12:05:00 +0100 |
| commit | b1a056f77e793efc45df34ab7bf78fbec1bf8a59 (patch) | |
| tree | ff7658114702d5fe5e0b4d25cbca9281394672d1 | |
| parent | b83897ae49fdee1fda73c10c7fe73362bfaba690 (diff) | |
| download | samba-b1a056f77e793efc45df34ab7bf78fbec1bf8a59.tar.gz | |
CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG
We should only use GSS_C_DELEG_POLICY_FLAG in order to let
the KDC decide if we should send delegated credentials to
a remote server.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
| -rw-r--r-- | source3/librpc/crypto/gse.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c index f1ebe19fa79..9c9f55d4f3d 100644 --- a/source3/librpc/crypto/gse.c +++ b/source3/librpc/crypto/gse.c @@ -142,7 +142,6 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx, memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG | - GSS_C_DELEG_FLAG | GSS_C_DELEG_POLICY_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG; |