5 ms·
Critical Samba flaw presents code execution threat
- raintrees 5y agoThe wife is going to be tickled with this module name...
- wtallis 5y agoThe article probably should probably mention that this vfs_fruit module provides Apple-specific features and is mostly used to allow Samba to be the target for Mac Time Machine backups.
- stragies 5y ago"The vfs_fruit module provides enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver."
- mzs 5y agohttps://www.samba.org/samba/security/CVE-2021-44142.html https://www.samba.org/samba/security/CVE-2021-44142.html
- e12e 5y agoThank you. And for those that don't know why you would want fruit when dancing: > vfs_fruit — Enhanced OS X and Netatalk interoperability Synopsis > (...) > The vfs_fruit module provides enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver. https://www.samba.org/samba/docs/current/man-html/vfs_fruit.8.html https://www.samba.org/samba/docs/current/man-html/vfs_fruit....
- blibble 5y agois that enabled by default? previously I've had to enable vfs objects manually
- jra_samba 5y agoNo it is not enabled by default.
- denton-scratch 5y agoOh dear - that makes the title a bit clickbaity. I wondered what vfs_fruit was. https://www.samba.org/samba/docs/current/man-html/vfs_fruit.8.html https://www.samba.org/samba/docs/current/man-html/vfs_fruit.... I've never had to tangle with (OSX or Apple) and Samba, which explains my ignorance. It's not clear whether you have to actually use the driver, or whether the vuln is exposed simply by mentioning it in a config file.
- jra_samba 5y agoPutting it in the vfs objects = list causes the module to be loaded, so enabling the vulnerability.
- OneLeggedCat 5y agoI don't think it's clickbaity. Some distros do enable it by default, since it helps Apple compatibility.
- jamesy0ung 5y agoI don't even use Samba. NFS is supported on Windows 10/11 for when I have to use Windows.
- jra_samba 5y agoFor merely copying files NFS is fine (personally I use scp for that). But when you need to host content that Windows apps want to use with full Windows semantics, then SMB is the way to go.
- vorpalhex 5y agoNote that NFS support on Windows is only for pro editions, quite frustratingly.
- warent 5y agoSamba is SO SLOW in Mac as well. My gigabit local ethernet connection is somehow slower than my internet connection. Anyone have suggestions of what to use besides SMB?
- jra_samba 5y agoMore details please. What server are you connecting to locally ?
- warent 5y agoUbuntu 20.04 https://forums.macrumors.com/threads/very-slow-access-to-smb-and-afp-shares.2285822/ https://forums.macrumors.com/threads/very-slow-access-to-smb... Google search "SMB Slow on Mac"
- jra_samba 5y agoAre you using signing/encryption ? Never mind, saw the local "gigabit connection" above, so wired.
- beermonster 5y agoSince MacOS 10.11.5 SMB signing is enabled by default which does impact performance.
- paulmd 5y agoNFS would be the traditional *nix answer there. SMB is also moderately CPU bottlenecked, especially depending on cipher suite, so if you're connecting to a super slow raspberry pi server or something, move to a decent server before writing it all off.
- rietta 5y agoNFS has its own issues, such as not being authenticated. SMB does support credentials and TLS for access.
- aborsy 5y agoThis could impact NAS devices from Synology and QNAP. These companies use old kernels, offer a lot of fancy features and are also slow to patch.
- symlinkk 5y agoSynology has had a patch since January 26th - https://www.synology.com/en-us/security/advisory/Synology_SA_22_02 https://www.synology.com/en-us/security/advisory/Synology_SA...