[Pkg-samba-maint] [samba] 02/07: CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss

[Mathieu Parent]

This is an automated email from the git hooks/post-receive script.

sathieu pushed a commit to branch jessie
in repository samba.

commit d8670e6100b2c722d724d884f8dc8c0cf6da5f7f
Author: Stefan Metzmacher <metze at samba.org>
Date:   Wed Nov 23 11:41:10 2016 +0100

    CVE-2016-2125: s4:scripting: don't use GSS_C_DELEG_FLAG in nsupdate-gss
    
    This is just an example script that's not directly used by samba,
    but we should avoid sending delegated credentials to dns servers.
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=12445
    
    Signed-off-by: Stefan Metzmacher <metze at samba.org>
    Reviewed-by: Alexander Bokovoy <ab at samba.org>
    Reviewed-by: Simo Sorce <idra at samba.org>
---
 source4/scripting/bin/nsupdate-gss | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source4/scripting/bin/nsupdate-gss b/source4/scripting/bin/nsupdate-gss
index dec5916..509220d 100755
--- a/source4/scripting/bin/nsupdate-gss
+++ b/source4/scripting/bin/nsupdate-gss
@@ -178,7 +178,7 @@ sub negotiate_tkey($$$$)
     my $flags = 
 	GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | 
 	GSS_C_SEQUENCE_FLAG | GSS_C_CONF_FLAG | 
-	GSS_C_INTEG_FLAG | GSS_C_DELEG_FLAG;
+	GSS_C_INTEG_FLAG;
 
 
     $status = GSSAPI::Cred::acquire_cred(undef, 120, undef, GSS_C_INITIATE,

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-samba/samba.git