| 1 |
unnilennium |
1.1 |
From f775874f1c9e388d51fe04cb9df849c66bc6e8b6 Mon Sep 17 00:00:00 2001 |
| 2 |
|
|
From: Stefan Metzmacher <metze@samba.org> |
| 3 |
|
|
Date: Wed, 23 Nov 2016 11:41:10 +0100 |
| 4 |
|
|
Subject: [PATCH 1/3] CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG |
| 5 |
|
|
in nsupdate-gss |
| 6 |
|
|
|
| 7 |
|
|
This is just an example script that's not directly used by samba, |
| 8 |
|
|
but we should avoid sending delegated credentials to dns servers. |
| 9 |
|
|
|
| 10 |
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445 |
| 11 |
|
|
|
| 12 |
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org> |
| 13 |
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org> |
| 14 |
|
|
Reviewed-by: Simo Sorce <idra@samba.org> |
| 15 |
|
|
--- |
| 16 |
|
|
source4/scripting/bin/nsupdate-gss | 2 +- |
| 17 |
|
|
1 file changed, 1 insertion(+), 1 deletion(-) |
| 18 |
|
|
|
| 19 |
|
|
diff --git a/source4/scripting/bin/nsupdate-gss b/source4/scripting/bin/nsupdate-gss |
| 20 |
|
|
index dec5916..509220d 100755 |
| 21 |
|
|
--- a/source4/scripting/bin/nsupdate-gss |
| 22 |
|
|
+++ b/source4/scripting/bin/nsupdate-gss |
| 23 |
|
|
@@ -178,7 +178,7 @@ sub negotiate_tkey($$$$) |
| 24 |
|
|
my $flags = |
| 25 |
|
|
GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | |
| 26 |
|
|
GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG | |
| 27 |
|
|
- GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG; |
| 28 |
|
|
+ GSS_C_INTEG_FLAG; |
| 29 |
|
|
|
| 30 |
|
|
|
| 31 |
|
|
$status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE, |
| 32 |
|
|
-- |
| 33 |
|
|
1.9.1 |
| 34 |
|
|
|
| 35 |
|
|
|
| 36 |
|
|
From 1bee1eb5d75191e142c503cf9c5dc36df2453307 Mon Sep 17 00:00:00 2001 |
| 37 |
|
|
From: Stefan Metzmacher <metze@samba.org> |
| 38 |
|
|
Date: Wed, 23 Nov 2016 11:42:59 +0100 |
| 39 |
|
|
Subject: [PATCH 2/3] CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG |
| 40 |
|
|
|
| 41 |
|
|
We should only use GSS_C_DELEG_POLICY_FLAG in order to let |
| 42 |
|
|
the KDC decide if we should send delegated credentials to |
| 43 |
|
|
a remote server. |
| 44 |
|
|
|
| 45 |
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445 |
| 46 |
|
|
|
| 47 |
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org> |
| 48 |
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org> |
| 49 |
|
|
Reviewed-by: Simo Sorce <idra@samba.org> |
| 50 |
|
|
--- |
| 51 |
|
|
source3/librpc/crypto/gse.c | 1 - |
| 52 |
|
|
1 file changed, 1 deletion(-) |
| 53 |
|
|
|
| 54 |
|
|
diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c |
| 55 |
|
|
index 963c98a..c4c4bbc 100644 |
| 56 |
|
|
--- a/source3/librpc/crypto/gse.c |
| 57 |
|
|
+++ b/source3/librpc/crypto/gse.c |
| 58 |
|
|
@@ -142,7 +142,6 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx, |
| 59 |
|
|
memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc)); |
| 60 |
|
|
|
| 61 |
|
|
gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG | |
| 62 |
|
|
- GSS_C_DELEG_FLAG | |
| 63 |
|
|
GSS_C_DELEG_POLICY_FLAG | |
| 64 |
|
|
GSS_C_REPLAY_FLAG | |
| 65 |
|
|
GSS_C_SEQUENCE_FLAG; |
| 66 |
|
|
-- |
| 67 |
|
|
1.9.1 |
| 68 |
|
|
|
| 69 |
|
|
|
| 70 |
|
|
From 2c9d1648745ddc9facaf5b9cc84ea7f1117d7710 Mon Sep 17 00:00:00 2001 |
| 71 |
|
|
From: Stefan Metzmacher <metze@samba.org> |
| 72 |
|
|
Date: Wed, 23 Nov 2016 11:44:22 +0100 |
| 73 |
|
|
Subject: [PATCH 3/3] CVE-2016-2125: s4:gensec_gssapi: don't use |
| 74 |
|
|
GSS_C_DELEG_FLAG by default |
| 75 |
|
|
|
| 76 |
|
|
This disabled the usage of GSS_C_DELEG_FLAG by default, as |
| 77 |
|
|
GSS_C_DELEG_POLICY_FLAG is still used by default we let the |
| 78 |
|
|
KDC decide if we should send delegated credentials to a remote server. |
| 79 |
|
|
|
| 80 |
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445 |
| 81 |
|
|
|
| 82 |
|
|
Signed-off-by: Stefan Metzmacher <metze@samba.org> |
| 83 |
|
|
Reviewed-by: Alexander Bokovoy <ab@samba.org> |
| 84 |
|
|
Reviewed-by: Simo Sorce <idra@samba.org> |
| 85 |
|
|
--- |
| 86 |
|
|
source4/auth/gensec/gensec_gssapi.c | 2 +- |
| 87 |
|
|
1 file changed, 1 insertion(+), 1 deletion(-) |
| 88 |
|
|
|
| 89 |
|
|
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c |
| 90 |
|
|
index e0b2bf2..e2994f6 100644 |
| 91 |
|
|
--- a/source4/auth/gensec/gensec_gssapi.c |
| 92 |
|
|
+++ b/source4/auth/gensec/gensec_gssapi.c |
| 93 |
|
|
@@ -115,7 +115,7 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security) |
| 94 |
|
|
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "mutual", true)) { |
| 95 |
|
|
gensec_gssapi_state->gss_want_flags |= GSS_C_MUTUAL_FLAG; |
| 96 |
|
|
} |
| 97 |
|
|
- if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", true)) { |
| 98 |
|
|
+ if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "delegation", false)) { |
| 99 |
|
|
gensec_gssapi_state->gss_want_flags |= GSS_C_DELEG_FLAG; |
| 100 |
|
|
} |
| 101 |
|
|
if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "replay", true)) { |
| 102 |
|
|
-- |
| 103 |
|
|
1.9.1 |
| 104 |
|
|
|
Parent Directory
| 
Revision Log
| 
Revision Graph
