From 639bd4da76f1493592c6d4feee3cc3d7b6dec872 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 20 Nov 2015 11:42:55 +0100 Subject: [PATCH] CVE-2016-2110: auth/gensec: fix the client side of a spnego downgrade MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit New servers response with SPNEGO_REQUEST_MIC instead of SPNEGO_ACCEPT_INCOMPLETE to a downgrade. With just KRB5 and NTLMSSP this doesn't happen, but we want to be prepared for the future. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644 Signed-off-by: Stefan Metzmacher Reviewed-by: Günther Deschner --- auth/gensec/spnego.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/auth/gensec/spnego.c b/auth/gensec/spnego.c index af5231ae142..3fcd057f4da 100644 --- a/auth/gensec/spnego.c +++ b/auth/gensec/spnego.c @@ -970,13 +970,15 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA } /* Server didn't like our choice of mech, and chose something else */ - if ((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) && + if (((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) || + (spnego.negTokenTarg.negResult == SPNEGO_REQUEST_MIC)) && spnego.negTokenTarg.supportedMech && strcmp(spnego.negTokenTarg.supportedMech, spnego_state->neg_oid) != 0) { DEBUG(3,("GENSEC SPNEGO: client preferred mech (%s) not accepted, server wants: %s\n", - gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech), - gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid))); + gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid), + gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech))); + spnego_state->no_response_expected = false; talloc_free(spnego_state->sub_sec_security); nt_status = gensec_subcontext_start(spnego_state, gensec_security, -- 2.47.2