sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-08 21:18:16 +03:00
Code

CVE-2022-37966 docs-xml/smbdotconf: "kerberos encryption types = legacy" should not be used

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit a4f6f51cbe)
This commit is contained in:
Stefan Metzmacher 2022-12-05 21:31:37 +01:00
parent a65fc1fa47
commit 05206c0923
1 changed files with 3 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
docs-xml/smbdotconf/security/kerberosencryptiontypes.xml
View File

@ -37,15 +37,9 @@
</para>
<para>When set to <constant>legacy</constant>, only RC4-HMAC-MD5
is allowed. Avoiding AES this way has one a very specific use.
Normally, the encryption type is negotiated between the peers.
However, there is one scenario in which a Windows read-only domain
controller (RODC) advertises AES encryption, but then proxies the
request to a writeable DC which may not support AES encryption,
leading to failure of the handshake. Setting this parameter to
<constant>legacy</constant> would cause samba not to negotiate AES
encryption. It is assumed of course that the weaker legacy
encryption types are acceptable for the setup.
is allowed. AVOID using this option, because of
<ulink url="https://www.samba.org/samba/security/CVE-2022-37966.html">CVE-2022-37966</ulink> see
<ulink url="https://bugzilla.samba.org/show_bug.cgi?id=15237">https://bugzilla.samba.org/show_bug.cgi?id=15237</ulink>.
</para>
</description>