| Subject: | Bug in NTLM challenge generation |
Wrong domain-length is being put in challenge message. Currently it's
computed as length($domain) but it should be length of unicoded domain
(2xlonger usually).
I attached the patch to fix this problem. Tested it and it's working for me.
Tested it on:
1. CentOS i386 2.6.18, perl 5.8.8, package version 0.12
2. WinXP x86, ActivePerl 5.8.9, package version 0.12
In order to observe the problem one can use some packet sniffer (I used
Wireshark) and watch how it parsed "domain" field in NTLMSSP part of
generated WWW-Authenticate header.
Cheers
| Subject: | NTLM.patch |
--- /root/NTLM.pm 2010-12-08 12:00:06.000000000 +0100
+++ NTLM.pm 2010-12-08 12:02:33.000000000 +0100
@@ -241,16 +241,17 @@
my ($self) = @_;
my $flags = pack("V", $_[1]);
my $domain = $self->{'domain'};
+ my $udomain = unicodify($domain);
my $msg = NTLMSSP_SIGNATURE . chr(0);
$self->{'cChallenge'} += 0x100;
$msg .= pack("V", NTLMSSP_CHALLENGE);
- $msg .= pack("v", length($domain)) . pack("v", length($domain)) . pack("V", 48);
+ $msg .= pack("v", length($udomain)) . pack("v", length($udomain)) . pack("V", 48);
$msg .= $flags;
$msg .= compute_nonce($self->{'cChallenge'});
$msg .= pack("VV", 0, 0); # 8 bytes of reserved 0s
$msg .= pack("V", 0); # ServerContextHandleLower
$msg .= pack("V", 0x3c); # ServerContextHandleUpper
- $msg .= unicodify($domain);
+ $msg .= $udomain;
return $msg;
}