Ethereal-dev: [Ethereal-dev] Bug in packet-http.c: http 'Authorization: Negotiate' parsing err

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Yaniv Kaul <ykaul@xxxxxxxxxxxx>
Date: Mon, 23 Feb 2004 15:01:46 +0200
In check_auth_ntlmssp(), there is an implict assumption that if the value of 'Authorization' is 'Negotiate', it is has to be NTLMSSP authentication. This is wrong. It may be SPNEGO. How about calling this dissector instead of ntlmssp (in dissect_http_ntlmssp) ? See http://bofriis.dk/portalprotect/SPNEGO%20authentication%20using%20JGSS.pdf for more information. 
Seen on 0.10.1