s3:ntlmssp Don't permit LM_KEY in combination with NTLMv2

[ira/wip.git] / source3 / libsmb / ntlmssp.c

diff --git a/source3/libsmb/ntlmssp.c b/source3/libsmb/ntlmssp.c
index 7ac20826de517a36f864c73b03fb84050428b9cb..2fdc938f49e9c1ba3aad25ba5cd9d8b68d4d498f 100644 (file)
--- a/source3/libsmb/ntlmssp.c
+++ b/source3/libsmb/ntlmssp.c
@@ -617,7 +617,10 @@ static NTSTATUS ntlmssp_server_auth(struct ntlmssp_state *ntlmssp_state,
                        DEBUG(10,("ntlmssp_server_auth: Failed to create NTLM2 session key.\n"));
                        session_key = data_blob_null;
                }
-       } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
+       } else if ((ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY)
+               /* Ensure we can never get here on NTLMv2 */
+               && (ntlmssp_state->nt_resp.length == 0 || ntlmssp_state->nt_resp.length == 24)) {
+
                if (lm_session_key.data && lm_session_key.length >= 8) {
                        if (ntlmssp_state->lm_resp.data && ntlmssp_state->lm_resp.length == 24) {
                                session_key = data_blob_talloc(ntlmssp_state,