diff options
| author | Stefan Metzmacher <metze@samba.org> | 2016-11-23 11:44:22 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2016-12-09 09:55:41 +0100 |
| commit | 8c31d69461cb54cb7f5d7b04fda2e52718d9990d (patch) | |
| tree | fb748be9d13ff87bccfa0716d0f5fae401621c39 | |
| parent | ff8a94caab2b9705ef393791140380ad70291e12 (diff) | |
| download | samba-8c31d69461cb54cb7f5d7b04fda2e52718d9990d.tar.gz | |
CVE-2016-2125: s4:gensec_gssapi: don't use GSS_C_DELEG_FLAG by default
This disabled the usage of GSS_C_DELEG_FLAG by default, as
GSS_C_DELEG_POLICY_FLAG is still used by default we let the
KDC decide if we should send delegated credentials to a remote server.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Simo Sorce <idra@samba.org>
| -rw-r--r-- | source4/auth/gensec/gensec_gssapi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c index e0b2bf2598e..e2994f62d2d 100644 --- a/source4/auth/gensec/gensec_gssapi.c +++ b/source4/auth/gensec/gensec_gssapi.c @@ -115,7 +115,7 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security) if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) { gensec_gssapi_state->gss_want_flags |= GSS_C_MUTUAL_FLAG; } - if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) { + if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", false)) { gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_FLAG; } if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) { |