From f8c3a4643ff13f967ad529cf523c0b3259f5095f Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 18 Dec 2015 08:29:50 +0100
Subject: [PATCH] CVE-2016-2112: s4:libcli/ldap: auto upgrade to SIGN after
 STRONG_AUTH_REQUIRED
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
---
 source4/libcli/ldap/ldap_bind.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 41037e76e38..397b4cb3e44 100644
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -437,6 +437,13 @@ try_logon_again:
 
 		result = response->r.BindResponse.response.resultcode;
 
+		if (result == LDAP_STRONG_AUTH_REQUIRED) {
+			if (wrap_flags == 0) {
+				wrap_flags = ADS_AUTH_SASL_SIGN;
+				goto try_logon_again;
+			}
+		}
+
 		if (result == LDAP_INVALID_CREDENTIALS) {
 			/*
 			  try a second time on invalid credentials, to
-- 
2.47.2