fedora 23
access weakness #5

Weakness Breakdown

Definition:

An access weakness occurs when software does not properly implement permissions that could have unintended consequences if exploited by malicious actors. An example of this weakness is when a default username and password are set by the developer but do not get changed by the system administrator.

Warning code(s):

If this call fails, the program could fail to drop heightened privileges.

File Name:

FreeRDP-24a752a70840f3e4b027ba7c020af71f2bcfd94a/winpr/libwinpr/sspi/sspi_export.c

Context:

The highlighted line of code below is the trigger point of this particular Fedora 23 access weakness.

 
extern SECURITY_STATUS SEC_ENTRY sspi_CompleteAuthToken(void*, void*);

SSPI_EXPORT SECURITY_STATUS SEC_ENTRY CompleteAuthToken(void* phContext, void* pToken)
{
	return sspi_CompleteAuthToken(phContext, pToken);
}

extern SECURITY_STATUS SEC_ENTRY sspi_DeleteSecurityContext(void*);

SSPI_EXPORT SECURITY_STATUS SEC_ENTRY DeleteSecurityContext(void* phContext)
{
	return sspi_DeleteSecurityContext(phContext);
}

extern SECURITY_STATUS SEC_ENTRY sspi_FreeContextBuffer(void*);

SSPI_EXPORT SECURITY_STATUS SEC_ENTRY FreeContextBuffer(void* pvContextBuffer)
{
	return sspi_FreeContextBuffer(pvContextBuffer);
}

extern SECURITY_STATUS SEC_ENTRY sspi_ImpersonateSecurityContext(void*);

SSPI_EXPORT SECURITY_STATUS SEC_ENTRY ImpersonateSecurityContext(void* phContext)
{
	return sspi_ImpersonateSecurityContext(phContext);
}

extern SECURITY_STATUS SEC_ENTRY sspi_InitializeSecurityContextW(void*, void*, void*, ULONG, ULONG, ULONG,
								     void*, ULONG, void*, void*, void*, void*);

SSPI_EXPORT SECURITY_STATUS SEC_ENTRY InitializeSecurityContextW(void* phCredential, void* phContext,
		void* pszTargetName, ULONG fContextReq, ULONG Reserved1, ULONG TargetDataRep,
		void* pInput, ULONG Reserved2, void* phNewContext,
		void* pOutput, void* pfContextAttr, void* ptsExpiry)
{
	return sspi_InitializeSecurityContextW(phCredential, phContext, pszTargetName, fContextReq, Reserved1,
		TargetDataRep, pInput, Reserved2, phNewContext, pOutput, pfContextAttr, ptsExpiry);
}

extern SECURITY_STATUS SEC_ENTRY sspi_InitializeSecurityContextA(void*, void*, void*, ULONG, ULONG, ULONG,
								     void*, ULONG, void*, void*, void*, void*);

SSPI_EXPORT SECURITY_STATUS SEC_ENTRY InitializeSecurityContextA(void* phCredential, void* phContext,
		void* pszTargetName, ULONG fContextReq, ULONG Reserved1, ULONG TargetDataRep,
		void* pInput, ULONG Reserved2, void* phNewContext,
		void* pOutput, void* pfContextAttr, void* ptsExpiry)
{
	return sspi_InitializeSecurityContextA(phCredential, phContext, pszTargetName, fContextReq, Reserved1,