CVE-2016-2112: s4:libcli/ldap: auto upgrade to SIGN after STRONG_AUTH_REQUIRED

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

diff --git a/source4/libcli/ldap/ldap_bind.c b/source4/libcli/ldap/ldap_bind.c
index 79478e775d8115c52cabb7d8234c7f0bd359106d..c5d821982c6acc41bd538e5286f1159029ce83b6 100644 (file)
--- a/source4/libcli/ldap/ldap_bind.c
+++ b/source4/libcli/ldap/ldap_bind.c
@@ -437,6 +437,13 @@ try_logon_again:
 
                result = response->r.BindResponse.response.resultcode;
 
+               if (result == LDAP_STRONG_AUTH_REQUIRED) {
+                       if (wrap_flags == 0) {
+                               wrap_flags = ADS_AUTH_SASL_SIGN;
+                               goto try_logon_again;
+                       }
+               }
+
                if (result == LDAP_INVALID_CREDENTIALS) {
                        /*
                          try a second time on invalid credentials, to