Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Samba 3.5.0+ vulnerability: Remote code execution from a writable share

samba.org

Post reply on HN
Print view View original

1–10 of 14 posts

Re: Samba 3.5.0+ vulnerability: Remote code execution from a writable share

#3

Post by tyingq »

mynewtb wrote: post #2

Is this something new or ETERNALBLUE?

Looks new. ETERNALBLUE was a buffer overflow, and not in Samba. This is Samba not restricting access to certain named pipes...the "IPC$ share" that can spawn processes.

The fix disallows open on pipes with a name that starts with / : https://github.com/samba-team/samba/commit/02a76d86db0cbe79f...

Re: Samba 3.5.0+ vulnerability: Remote code execution from a writable share

#7

Post by benmmurphy »

tyingq wrote: post #3
mynewtb wrote: post #2

Is this something new or ETERNALBLUE?

Looks new. ETERNALBLUE was a buffer overflow, and not in Samba. This is Samba not restricting access to certain named pipes...the "IPC$ share" that can spawn processes. The fix disallows open on pipes with a name that starts with / : https://github.com/samba-team/samba/commit/02a76d86db0cbe79f...

from what i gather they pass the pipename into smb_probe_module which ends up calling dlopen

    status = smb_probe_module("rpc", pipename);
my guess is you can either pass in a pipename starting with / which will cause it to be treated absolutely or ../../ which will cause dlopen to do a relative lookup

Re: Samba 3.5.0+ vulnerability: Remote code execution from a writable share

#8

Post by benmmurphy »

legulere wrote: post #4

What's the vulnerability? C memory unsafety?

its a logic bug. they have some magic that loads modules at runtime based on a string a user supplies. but it doesn't take into account a user might be able to pass in / (i'm thinking absolute is probably not possible) or ../ which causes the module resolution to be done differently.

Re: Samba 3.5.0+ vulnerability: Remote code execution from a writable share

#9

Post by HeadlessChild »

syvanen wrote: post #6

Info of fixed versions: Debian: https://security-tracker.debian.org/tracker/CVE-2017-7494 Ubuntu: https://www.ubuntu.com/usn/usn-3296-1/ Red Hat: https://access.redhat.com/security/cve/CVE-2017-7494

That is really handy. Thanks for the info!

Re: Samba 3.5.0+ vulnerability: Remote code execution from a writable share

#10

Post by tyingq »

benmmurphy wrote: post #7
tyingq wrote: post #3

Earlier quoted context omitted.

Looks new. ETERNALBLUE was a buffer overflow, and not in Samba. This is Samba not restricting access to certain named pipes...the "IPC$ share" that can spawn processes. The fix disallows open on pipes with a name that starts with / : https://github.com/samba-team/samba/commit/02a76d86db0cbe79f...

from what i gather they pass the pipename into smb_probe_module which ends up calling dlopen status = smb_probe_module("rpc", pipename); my guess is you can either pass in a pipename starting with / which will cause it to be treated absolutely or ../../ which will cause dlopen to do a relative lookup

Ah, yes...I initially summarized the fix incorrectly. It's strchr(), so disallows a pipe name with ANY slashes in it.
Post reply on HN