[Pkg-samba-maint] [samba] 03/07: CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG

[Mathieu Parent]

This is an automated email from the git hooks/post-receive script.

sathieu pushed a commit to branch jessie
in repository samba.

commit ecd6cb18fbc3d02110c70af84bc24617a41885bd
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Nov 23 11:42:59 2016 +0100

    CVE-2016-2125: s3:gse: avoid using GSS_C_DELEG_FLAG
    
    We should only use GSS_C_DELEG_POLICY_FLAG in order to let
    the KDC decide if we should send delegated credentials to
    a remote server.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Alexander Bokovoy <ab at samba.org>
    Reviewed-by: Simo Sorce <idra at samba.org>
---
 source3/librpc/crypto/gse.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index 82c8085..8639f75 100644
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -142,7 +142,6 @@ static NTSTATUS gse_context_init(TALLOC_CTX *mem_ctx,
 	memcpy(&gse_ctx->gss_mech, gss_mech_krb5, sizeof(gss_OID_desc));
 
 	gse_ctx->gss_want_flags = GSS_C_MUTUAL_FLAG |
-				GSS_C_DELEG_FLAG |
 				GSS_C_DELEG_POLICY_FLAG |
 				GSS_C_REPLAY_FLAG |
 				GSS_C_SEQUENCE_FLAG;

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-samba/samba.git