CVE-2016-2110: auth/ntlmssp: implement new_spnego support including MIC checking...
authorStefan Metzmacher <metze@samba.org>
Thu, 19 Nov 2015 15:02:58 +0000 (16:02 +0100)
committerStefan Metzmacher <metze@samba.org>
Mon, 28 Mar 2016 22:42:08 +0000 (00:42 +0200)
commit48b24cebe5c8c516ea29b6cc33c2697e5a42bb2f
tree1b38e03aa0c38a0fc528641d8c1a69ad3ac103cf
parentbb904577b8352915ce4549b7a326dcbf8ad6f0f6
CVE-2016-2110: auth/ntlmssp: implement new_spnego support including MIC checking (as server)

We now include a MsvAvTimestamp in our target info as indication
for the client to include a NTLMSSP_MIC in the AUTH_MESSAGE.
If the client uses NTLMv2 we check NTLMSSP_AVFLAG_MIC_IN_AUTHENTICATE_MESSAGE
and require a valid MIC.

This is still disabled if the "map to guest" feature is used.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>
auth/ntlmssp/gensec_ntlmssp.c
auth/ntlmssp/gensec_ntlmssp_server.c
auth/ntlmssp/ntlmssp.h
auth/ntlmssp/ntlmssp_server.c