4 ms·

Is this something new or ETERNALBLUE?

• tyingq 9y ago
  Looks new. ETERNALBLUE was a buffer overflow, and not in Samba. This is Samba not restricting access to certain named pipes...the "IPC$ share" that can spawn processes. The fix disallows open on pipes with a name that starts with / : https://github.com/samba-team/samba/commit/02a76d86db0cbe79fcaf1a500630e24d961fa149 https://github.com/samba-team/samba/commit/02a76d86db0cbe79f...
  • benmmurphy 9y ago
    from what i gather they pass the pipename into smb_probe_module which ends up calling dlopen status = smb_probe_module("rpc", pipename); my guess is you can either pass in a pipename starting with / which will cause it to be treated absolutely or ../../ which will cause dlopen to do a relative lookup
    • tyingq 9y ago
      Ah, yes...I initially summarized the fix incorrectly. It's strchr(), so disallows a pipe name with ANY slashes in it.
• NetStrikeForce 9y ago
  This is Samba, not the Windows implementation of SMB.