samba-mirror

mirror of https://github.com/samba-team/samba.git synced 2025-01-25 06:04:04 +03:00

History

Stefan Metzmacher 151b6145e1 CVE-2020-25719 CVE-2020-25717: auth/gensec: always require a PAC in domain mode (DC or member)

AD domains always provide a PAC unless UF_NO_AUTH_DATA_REQUIRED is set
on the service account, which can only be explicitly configured,
but that's an invalid configuration!

We still try to support standalone servers in an MIT realm,
as legacy setup.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14801
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

[jsutton@samba.org Removed knownfail entries]

2021-11-08 10:46:43 +01:00

credentials

CVE-2020-25722 selftest: allow for future failures in BindTests.test_virtual_email_account_style_bind

2021-11-08 10:46:42 +01:00

gensec

CVE-2020-25719 CVE-2020-25717: auth/gensec: always require a PAC in domain mode (DC or member)

2021-11-08 10:46:43 +01:00

kerberos

auth/kerberos: add auth4_context_{for,get}_PAC_DATA_CTR() helpers

2020-02-10 16:32:36 +00:00

ntlmssp

CVE-2020-25717: auth/ntlmssp: start with authoritative = 1