+++ /dev/null
-From 126e3e992bed7174d60ee19212db9b717647ab2e Mon Sep 17 00:00:00 2001
-From: Andreas Schneider <asn@cryptomilk.org>
-Date: Wed, 30 Mar 2016 16:55:44 +0200
-Subject: [PATCH 1/3] CVE-2016-2112: s3:ntlmssp: Implement missing
- ntlmssp_have_feature()
-
-Signed-off-by: Andreas Schneider <asn@samba.org>
----
- source3/include/proto.h | 1 +
- source3/libsmb/ntlmssp.c | 30 ++++++++++++++++++++++++++++++
- 2 files changed, 31 insertions(+)
-
-diff --git a/source3/include/proto.h b/source3/include/proto.h
-index 32b4e3d..43008ea 100644
---- a/source3/include/proto.h
-+++ b/source3/include/proto.h
-@@ -1260,6 +1260,7 @@ NTSTATUS ntlmssp_set_password(struct ntlmssp_state *ntlmssp_state, const char *p
- NTSTATUS ntlmssp_set_domain(struct ntlmssp_state *ntlmssp_state, const char *domain) ;
- void ntlmssp_want_feature_list(struct ntlmssp_state *ntlmssp_state, char *feature_list);
- void ntlmssp_want_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature);
-+bool ntlmssp_have_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature);
- NTSTATUS ntlmssp_update(struct ntlmssp_state *ntlmssp_state,
- const DATA_BLOB in, DATA_BLOB *out) ;
- NTSTATUS ntlmssp_server_start(TALLOC_CTX *mem_ctx,
-diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c
-index 045dc87..7e58990 100644
---- a/source3/libsmb/ntlmssp.c
-+++ b/source3/libsmb/ntlmssp.c
-@@ -162,6 +162,36 @@ NTSTATUS ntlmssp_set_domain(struct ntlmssp_state *ntlmssp_state, const char *dom
- return NT_STATUS_OK;
- }
-
-+bool ntlmssp_have_feature(struct ntlmssp_state *ntlmssp_state,
-+ uint32_t feature)
-+{
-+ if (feature & NTLMSSP_FEATURE_SIGN) {
-+ if (ntlmssp_state->session_key.length == 0) {
-+ return false;
-+ }
-+ if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
-+ return true;
-+ }
-+ }
-+
-+ if (feature & NTLMSSP_FEATURE_SEAL) {
-+ if (ntlmssp_state->session_key.length == 0) {
-+ return false;
-+ }
-+ if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
-+ return true;
-+ }
-+ }
-+
-+ if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
-+ if (ntlmssp_state->session_key.length > 0) {
-+ return true;
-+ }
-+ }
-+
-+ return false;
-+}
-+
- /**
- * Request features for the NTLMSSP negotiation
- *
---
-2.8.1
-
-
-From 15338742e0c7304aeecce0e8368f0dad85e8075b Mon Sep 17 00:00:00 2001
-From: Ralph Boehme <slow@samba.org>
-Date: Thu, 24 Mar 2016 16:22:36 +0100
-Subject: [PATCH 2/3] CVE-2016-2112: s3:libads: make sure we detect downgrade
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644
-
-Pair-programmed-with: Ralph Boehme <slow@samba.org>
-
-Signed-off-by: Stefan Metzmacher <metze@samba.org>
-Signed-off-by: Ralph Boehme <slow@samba.org>
----
- source3/libads/sasl.c | 31 +++++++++++++++++++++++++++++++
- 1 file changed, 31 insertions(+)
-
-diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
-index e7daa8a..6690f83 100644
---- a/source3/libads/sasl.c
-+++ b/source3/libads/sasl.c
-@@ -261,6 +261,37 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
- /* we have a reference conter on ntlmssp_state, if we are signing
- then the state will be kept by the signing engine */
-
-+ if (ads->ldap.wrap_type >= ADS_SASLWRAP_TYPE_SEAL) {
-+ bool ok;
-+
-+ ok = ntlmssp_have_feature(ntlmssp_state,
-+ NTLMSSP_FEATURE_SEAL);
-+ if (!ok) {
-+ DEBUG(0,("The ntlmssp feature sealing request, but unavailable\n"));
-+ TALLOC_FREE(ntlmssp_state);
-+ return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
-+ }
-+
-+ ok = ntlmssp_have_feature(ntlmssp_state,
-+ NTLMSSP_FEATURE_SIGN);
-+ if (!ok) {
-+ DEBUG(0,("The ntlmssp feature signing request, but unavailable\n"));
-+ TALLOC_FREE(ntlmssp_state);
-+ return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
-+ }
-+
-+ } else if (ads->ldap.wrap_type >= ADS_SASLWRAP_TYPE_SIGN) {
-+ bool ok;
-+
-+ ok = ntlmssp_have_feature(ntlmssp_state,
-+ NTLMSSP_FEATURE_SIGN);
-+ if (!ok) {
-+ DEBUG(0,("The gensec feature signing request, but unavailable\n"));
-+ TALLOC_FREE(ntlmssp_state);
-+ return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
-+ }
-+ }
-+
- if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {
- ads->ldap.out.max_unwrapped = ADS_SASL_WRAPPING_OUT_MAX_WRAPPED - NTLMSSP_SIG_SIZE;
- ads->ldap.out.sig_size = NTLMSSP_SIG_SIZE;
---
-2.8.1
-
-
-From b020ae88f9024bcc868ed2d85879d14901db32e5 Mon Sep 17 00:00:00 2001
-From: Andrew Bartlett <abartlet@samba.org>
-Date: Fri, 5 Sep 2014 17:38:38 +1200
-Subject: [PATCH 3/3] CVE-2016-2112: winbindd: Change value of "ldap sasl
- wrapping" to sign
-
-This is to disrupt MITM attacks between us and our DC
-
-BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644
-
-Pair-programmed-with: Garming Sam <garming@catalyst.net.nz>
-Signed-off-by: Garming Sam <garming@catalyst.net.nz>
-Signed-off-by: Andrew Bartlett <abartlet@samba.org>
-(backported from commit afe02d12f444ad9a6abf31a61f578320520263a9)
----
- docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml | 8 +++-----
- source3/param/loadparm.c | 2 ++
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml
-index a926cec..a7c4395 100644
---- a/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml
-+++ b/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml
-@@ -34,11 +34,9 @@
- </para>
-
- <para>
-- The default value is <emphasis>plain</emphasis> which is not irritable
-- to KRB5 clock skew errors. That implies synchronizing the time
-- with the KDC in the case of using <emphasis>sign</emphasis> or
-- <emphasis>seal</emphasis>.
-+ The default value is <emphasis>sign</emphasis>. That implies synchronizing the time
-+ with the KDC in the case of using <emphasis>Kerberos</emphasis>.
- </para>
- </description>
--<value type="default">plain</value>
-+<value type="default">sign</value>
- </samba:parameter>
-diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
-index 7065cf6..c5249b7 100644
---- a/source3/param/loadparm.c
-+++ b/source3/param/loadparm.c
-@@ -5392,6 +5392,8 @@ static void init_globals(bool reinit_globals)
- Globals.ldap_debug_level = 0;
- Globals.ldap_debug_threshold = 10;
-
-+ Globals.client_ldap_sasl_wrapping = ADS_AUTH_SASL_SIGN;
-+
- /* This is what we tell the afs client. in reality we set the token
- * to never expire, though, when this runs out the afs client will
- * forget the token. Set to 0 to get NEVERDATE.*/
---
-2.8.1
-
projects / ipfire-2.x.git / blobdiff