4 ms·

It's not SMB. It's nothing to do with SMB. Please read the vulnerability disclosures.

raesene9 11y ago
so if I'm reading it correctly it's a downgrade attack where the attacker can MitM a connection? If so, I'm struggling to not agree that this has been overhyped a lot.
- jra_samba 11y ago
  I'm ambivalent towards the hype. The web site is nothing to do with the Samba Team. Having said that, this is an important enough bug that lots of vendors need to patch immediately, and the website really helped let them know that they needed to address this as soon as possible. Could it have been handled better ? Maybe, but you get back to me after you've coordinated security disclosure for 15+ major product vendors and give me some tips :-).
  - raesene9 11y ago
    Sorry I must have missed the bit where I impuned the rollout of the issue, or suggested I could have done it better? My comment related to the hype surrounding this bug, which I see (from an infosec point) as a bad thing. From https://www.samba.org/samba/history/security.html https://www.samba.org/samba/history/security.html it looks like there were 8 CVEs for bugs in samba this month and 14 in Microsoft's monthly patch bulletin (https://technet.microsoft.com/library/security/ms16-apr https://technet.microsoft.com/library/security/ms16-apr) Should all of those have logos and websites...? Do the other issues in these releases not need to be fixed...? So why is it a bad thing? Well to me it contributes to "vulnerability fatigue". the more issues that get hyped up and then don't turn out to be objectively more serious than many other issues that are getting release, the more people will dismiss efforts to draw attention to issues that come up.
    - jra_samba 11y ago
      This is the first DCE RPC protocol level vulnerability I'm aware of. DCE RPC isn't the web, but millions of businesses depend on it (mostly unknowingly) to do admin on their local networks every day. Not trying to mitigate someone else's hype, but from the Samba point of view this is one of the most serious bugs we've ever had to fix I think. We've had worse bugs that only affected Samba (root-level compromises, shudder), but the effect of this one is the most widespread.
      - tptacek 11y ago
        I'm not writing this to be argumentative, but to get a better idea of what you mean by "protocol level vulnerability". Do you mean, "vulnerability intrinsic in the DCE RPC protocol, and not in the application layer functionality on top of it"? Because, didn't the Welchia worm target DCE RPC?
        jra_samba 11y ago
        I mean intrinsic to the "bind" authentication part of the DCE RPC protocol. Because the connection level part of that isn't integrity protected then any mitm can downgrade it.
  - dsp1234 11y ago
    this is an important enough bug that lots of vendors need to patch immediately, I'm curious who those vendors are that have trivially MitM'able networks.
    - jra_samba 11y ago
      It's not the vendors, it's their customers :-).
  - deleted 11y ago
    [deleted]
tptacek 11y ago
Sorry. You're right, of course. I only skimmed the CVEs, and from painful memories of having to implement all that shit for scanner products, that whole bundle of protocols is just "SMB" in my head --- in particular, DCERPC to me is "stuff you do over a named pipe".
peterwwillis 11y ago
Because jra_samba doesn't want to elaborate: https://technet.microsoft.com/library/security/MS16-047 https://technet.microsoft.com/library/security/MS16-047 Update FAQs My application or product uses the SMB protocol, does this issue affect me? - No. Only applications and products that use the SAM or LSAD remote protocols are affected by this issue. The SMB protocol is not vulnerable. "An elevation of privilege vulnerability exists in the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote protocols when they accept authentication levels that do not protect them adequately. The vulnerability is caused by the way the SAM and LSAD remote protocols establish the Remote Procedure Call (RPC) channel. An attacker who successfully exploited this vulnerability could gain access to the SAM database. To exploit the vulnerability, an attacker could launch a man-in-the-middle (MiTM) attack, force a downgrade of the authentication level of the SAM and LSAD channels, and then impersonate an authenticated user. The security update addresses the vulnerability by modifying how the SAM and LSAD remote protocols handle authentication levels."
- jra_samba 11y ago
  Sorry, wasn't deliberately not elaborating. I hadn't read the Microsoft announcement yet, I've been too busy working on our side of things. Thanks for the link.

so if I'm reading it correctly it's a downgrade attack where the attacker can MitM a connection? If so, I'm struggling to not agree that this has been overhyped a lot.

jra_samba 11y ago
I'm ambivalent towards the hype. The web site is nothing to do with the Samba Team. Having said that, this is an important enough bug that lots of vendors need to patch immediately, and the website really helped let them know that they needed to address this as soon as possible. Could it have been handled better ? Maybe, but you get back to me after you've coordinated security disclosure for 15+ major product vendors and give me some tips :-).
- raesene9 11y ago
  Sorry I must have missed the bit where I impuned the rollout of the issue, or suggested I could have done it better? My comment related to the hype surrounding this bug, which I see (from an infosec point) as a bad thing. From https://www.samba.org/samba/history/security.html https://www.samba.org/samba/history/security.html it looks like there were 8 CVEs for bugs in samba this month and 14 in Microsoft's monthly patch bulletin (https://technet.microsoft.com/library/security/ms16-apr https://technet.microsoft.com/library/security/ms16-apr) Should all of those have logos and websites...? Do the other issues in these releases not need to be fixed...? So why is it a bad thing? Well to me it contributes to "vulnerability fatigue". the more issues that get hyped up and then don't turn out to be objectively more serious than many other issues that are getting release, the more people will dismiss efforts to draw attention to issues that come up.
  - jra_samba 11y ago
    This is the first DCE RPC protocol level vulnerability I'm aware of. DCE RPC isn't the web, but millions of businesses depend on it (mostly unknowingly) to do admin on their local networks every day. Not trying to mitigate someone else's hype, but from the Samba point of view this is one of the most serious bugs we've ever had to fix I think. We've had worse bugs that only affected Samba (root-level compromises, shudder), but the effect of this one is the most widespread.
    - tptacek 11y ago
      I'm not writing this to be argumentative, but to get a better idea of what you mean by "protocol level vulnerability". Do you mean, "vulnerability intrinsic in the DCE RPC protocol, and not in the application layer functionality on top of it"? Because, didn't the Welchia worm target DCE RPC?
      - jra_samba 11y ago
        I mean intrinsic to the "bind" authentication part of the DCE RPC protocol. Because the connection level part of that isn't integrity protected then any mitm can downgrade it.
- dsp1234 11y ago
  this is an important enough bug that lots of vendors need to patch immediately, I'm curious who those vendors are that have trivially MitM'able networks.
  - jra_samba 11y ago
    It's not the vendors, it's their customers :-).
- deleted 11y ago
  [deleted]

tptacek 11y ago

Sorry. You're right, of course. I only skimmed the CVEs, and from painful memories of having to implement all that shit for scanner products, that whole bundle of protocols is just "SMB" in my head --- in particular, DCERPC to me is "stuff you do over a named pipe".

peterwwillis 11y ago

Because jra_samba doesn't want to elaborate: https://technet.microsoft.com/library/security/MS16-047 https://technet.microsoft.com/library/security/MS16-047 Update FAQs My application or product uses the SMB protocol, does this issue affect me? - No. Only applications and products that use the SAM or LSAD remote protocols are affected by this issue. The SMB protocol is not vulnerable. "An elevation of privilege vulnerability exists in the Security Account Manager (SAM) and Local Security Authority (Domain Policy) (LSAD) remote protocols when they accept authentication levels that do not protect them adequately. The vulnerability is caused by the way the SAM and LSAD remote protocols establish the Remote Procedure Call (RPC) channel. An attacker who successfully exploited this vulnerability could gain access to the SAM database. To exploit the vulnerability, an attacker could launch a man-in-the-middle (MiTM) attack, force a downgrade of the authentication level of the SAM and LSAD channels, and then impersonate an authenticated user. The security update addresses the vulnerability by modifying how the SAM and LSAD remote protocols handle authentication levels."

jra_samba 11y ago
Sorry, wasn't deliberately not elaborating. I hadn't read the Microsoft announcement yet, I've been too busy working on our side of things. Thanks for the link.