From: Stefan Metzmacher Date: Fri, 20 Nov 2015 10:42:55 +0000 (+0100) Subject: CVE-2016-2110: auth/gensec: fix the client side of a spnego downgrade X-Git-Tag: samba-4.2.10~202 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=639bd4da76f1493592c6d4feee3cc3d7b6dec872;p=thirdparty%2Fsamba.git CVE-2016-2110: auth/gensec: fix the client side of a spnego downgrade New servers response with SPNEGO_REQUEST_MIC instead of SPNEGO_ACCEPT_INCOMPLETE to a downgrade. With just KRB5 and NTLMSSP this doesn't happen, but we want to be prepared for the future. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher Reviewed-by: Günther Deschner --- diff --git a/auth/gensec/spnego.c b/auth/gensec/spnego.c index af5231ae142..3fcd057f4da 100644 --- a/auth/gensec/spnego.c +++ b/auth/gensec/spnego.c @@ -970,13 +970,15 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA } /* Server didn't like our choice of mech, and chose something else */ - if ((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) && + if (((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) || + (spnego.negTokenTarg.negResult == SPNEGO_REQUEST_MIC)) && spnego.negTokenTarg.supportedMech && strcmp(spnego.negTokenTarg.supportedMech, spnego_state->neg_oid) != 0) { DEBUG(3,("GENSEC SPNEGO: client preferred mech (%s) not accepted, server wants: %s\n", - gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech), - gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid))); + gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid), + gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech))); + spnego_state->no_response_expected = false; talloc_free(spnego_state->sub_sec_security); nt_status = gensec_subcontext_start(spnego_state, gensec_security,