|
 |
9cd16f |
From f775874f1c9e388d51fe04cb9df849c66bc6e8b6 Mon Sep 17 00:00:00 2001
|
|
|
9cd16f |
From: Stefan Metzmacher <metze@samba.org>
|
|
|
9cd16f |
Date: Wed, 23 Nov 2016 11:41:10 +0100
|
|
|
9cd16f |
Subject: [PATCH 1/3] CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG
|
|
|
9cd16f |
in nsupdate-gss
|
|
|
9cd16f |
|
|
|
9cd16f |
This is just an example script that's not directly used by samba,
|
|
|
9cd16f |
but we should avoid sending delegated credentials to dns servers.
|
|
|
9cd16f |
|
|
|
9cd16f |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
|
|
|
9cd16f |
|
|
|
9cd16f |
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
|
9cd16f |
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
|
9cd16f |
Reviewed-by: Simo Sorce <idra@samba.org>
|
|
|
9cd16f |
---
|
|
|
9cd16f |
source4/scripting/bin/nsupdate-gss | 2 +-
|
|
|
9cd16f |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
9cd16f |
|
|
|
9cd16f |
diff --git a/source4/scripting/bin/nsupdate-gss b/source4/scripting/bin/nsupdate-gss
|
|
|
9cd16f |
index dec5916..509220d 100755
|
|
|
9cd16f |
--- a/source4/scripting/bin/nsupdate-gss
|
|
|
9cd16f |
+++ b/source4/scripting/bin/nsupdate-gss
|
|
|
9cd16f |
@@ -178,7 +178,7 @@ sub negotiate_tkey($$$$)
|
|
|
9cd16f |
my $flags =
|
|
|
9cd16f |
GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG |
|
|
|
9cd16f |
GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG |
|
|
|
9cd16f |
- GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG;
|
|
|
9cd16f |
+ GSS_C_INTEG_FLAG;
|
|
|
9cd16f |
|
|
|
9cd16f |
|
|
|
9cd16f |
$status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE,
|
|
|
9cd16f |
--
|
|
|
9cd16f |
1.9.1
|
|
|
9cd16f |
|
|
|
9cd16f |
|
|
|
9cd16f |
From 1bee1eb5d75191e142c503cf9c5dc36df2453307 Mon Sep 17 00:00:00 2001
|
|
|
9cd16f |
From: Stefan Metzmacher <metze@samba.org>
|
|
|
9cd16f |
Date: Wed, 23 Nov 2016 11:42:59 +0100
|
|
|
9cd16f |
Subject: [PATCH 2/3] CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG
|
|
|
9cd16f |
|
|
|
9cd16f |
We should only use GSS_C_DELEG_POLICY_FLAG in order to let
|
|
|
9cd16f |
the KDC decide if we should send delegated credentials to
|
|
|
9cd16f |
a remote server.
|
|
|
9cd16f |
|
|
|
9cd16f |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
|
|
|
9cd16f |
|
|
|
9cd16f |
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
|
9cd16f |
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
|
9cd16f |
Reviewed-by: Simo Sorce <idra@samba.org>
|
|
|
9cd16f |
---
|
|
|
9cd16f |
source3/librpc/crypto/gse.c | 1 -
|
|
|
9cd16f |
1 file changed, 1 deletion(-)
|
|
|
9cd16f |
|
|
|
9cd16f |
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
|
|
|
9cd16f |
index 963c98a..c4c4bbc 100644
|
|
|
9cd16f |
--- a/source3/librpc/crypto/gse.c
|
|
|
9cd16f |
+++ b/source3/librpc/crypto/gse.c
|
|
|
9cd16f |
@@ -142,7 +142,6 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
|
|
|
9cd16f |
memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
|
|
|
9cd16f |
|
|
|
9cd16f |
gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
|
|
|
9cd16f |
- GSS_C_DELEG_FLAG |
|
|
|
9cd16f |
GSS_C_DELEG_POLICY_FLAG |
|
|
|
9cd16f |
GSS_C_REPLAY_FLAG |
|
|
|
9cd16f |
GSS_C_SEQUENCE_FLAG;
|
|
|
9cd16f |
--
|
|
|
9cd16f |
1.9.1
|
|
|
9cd16f |
|
|
|
9cd16f |
|
|
|
9cd16f |
From 2c9d1648745ddc9facaf5b9cc84ea7f1117d7710 Mon Sep 17 00:00:00 2001
|
|
|
9cd16f |
From: Stefan Metzmacher <metze@samba.org>
|
|
|
9cd16f |
Date: Wed, 23 Nov 2016 11:44:22 +0100
|
|
|
9cd16f |
Subject: [PATCH 3/3] CVE-2016-2125: s4:gensec_gssapi: don't use
|
|
|
9cd16f |
GSS_C_DELEG_FLAG by default
|
|
|
9cd16f |
|
|
|
9cd16f |
This disabled the usage of GSS_C_DELEG_FLAG by default, as
|
|
|
9cd16f |
GSS_C_DELEG_POLICY_FLAG is still used by default we let the
|
|
|
9cd16f |
KDC decide if we should send delegated credentials to a remote server.
|
|
|
9cd16f |
|
|
|
9cd16f |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
|
|
|
9cd16f |
|
|
|
9cd16f |
Signed-off-by: Stefan Metzmacher <metze@samba.org>
|
|
|
9cd16f |
Reviewed-by: Alexander Bokovoy <ab@samba.org>
|
|
|
9cd16f |
Reviewed-by: Simo Sorce <idra@samba.org>
|
|
|
9cd16f |
---
|
|
|
9cd16f |
source4/auth/gensec/gensec_gssapi.c | 2 +-
|
|
|
9cd16f |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
9cd16f |
|
|
|
9cd16f |
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
|
|
|
9cd16f |
index e0b2bf2..e2994f6 100644
|
|
|
9cd16f |
--- a/source4/auth/gensec/gensec_gssapi.c
|
|
|
9cd16f |
+++ b/source4/auth/gensec/gensec_gssapi.c
|
|
|
9cd16f |
@@ -115,7 +115,7 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
|
|
|
9cd16f |
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) {
|
|
|
9cd16f |
gensec_gssapi_state->gss_want_flags |= GSS_C_MUTUAL_FLAG;
|
|
|
9cd16f |
}
|
|
|
9cd16f |
- if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) {
|
|
|
9cd16f |
+ if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", false)) {
|
|
|
9cd16f |
gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_FLAG;
|
|
|
9cd16f |
}
|
|
|
9cd16f |
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) {
|
|
|
9cd16f |
--
|
|
|
9cd16f |
1.9.1
|
|
|
9cd16f |
|