5 ms·

Samba remote execution vulnerability (CVE-2015-0240)

79 points by antoncohen 12y ago

AC__ 12y ago
Does the lack of comments correlate to everyone’s utter lack of surprise on this one lol?
- gus_massa 12y ago
  [[Just for the record, I didn't downvote you.] This is off topic, but I have read recently a few similar complains from another users. Each community has it use and customs. Here most of the people don't comment unless they have something very interesting to say or to ask. So if the article doesn't have an obvious flaw and is not polemic, you may see that it has a lot of upvotes and no comments. Also, try to avoid oneliners. It's very difficult to write good onliners and they will probably be downvoted. Explain the same idea with more words. [There is an "exception" for congratulations in post in acquisitions, marrying announcement of well known users and similar and similar happy occasions.]]
  - cpncrunch 12y ago
    It could also be due to the fact that a lot of HN readers won't be affected by this issue. If you run a web server, you generally don't have samba running. You also don't generally have samba publicly accessible on your home/development network. Generally the only people with access to samba are employees in your company, so the risk is much lower than for a service that is open to the public on the internet.
drzaiusapelord 12y ago
>execution of arbitrary code as root. How the hell is this still possible in this day and age? Why is this service running as root? It really is incredible how much bad decision making goes into your typical linux distro. This should be a non-root service with an ACL on whatever files samba needs to access. It doesn't "need" to be root. Reminds me of the Windows days where every service "needed" a System or Ring0 access and every application local admin rights. Its just incredible how there's nothing between a buffer overflow (which are common and will never go away considering the languages used) and root. I wonder if SELinux could even do anything here or if samba is such a security nightmare that you just have to give it root and hope for the best. Samba is the poster child of the ugly, hacky, security questionable code that we all should be working away from, not making excuses for: http://www.cvedetails.com/vulnerability-list/vendor_id-102/Samba.html http://www.cvedetails.com/vulnerability-list/vendor_id-102/S... If you want AD, pay for AD. If you want to share files with Windows clients you have a million options nowadays. This reverse-engineered pig is just a liability and helps keep real solutions from emerging because you can just install samba and be done with it. The technical debt and liabilities here are just kicked down the road. I wonder how bad this is going to get in the world of the "internet of things" and cheap NAS's with poor firewalling being sold by the millions. edit: downvotes dont suddenly make samba a good application
- throwaway2048 12y ago
  Your comment demonstrates zero understanding of what samba is, or why it might need root. Hint, its tied to authenticating users and accessing their files. Granted there could be better privilege separation, and a more modular approach, but just writing it off as "why is it running as root" is like asking why does sshd need to run as root. Its just a profoundly ignorant dismissal. EDIT: parent substantially edited his comment after this was posted
  - drzaiusapelord 12y ago
    If you need to be root to access Linux PAM, then linux is more fucked up than I thought. > Its just a profoundly ignorant dismissal. and its this FOSS jerk attitude that guarantees that things won't change. Linux is perfect! It cannot be criticized! sigh
    - barrkel 12y ago
      It's not just authentication, it's authorization. Files should be accessed with the identity of the remote user in order to present a consistent view of the file system, test and set permissions consistently, and set ownership consistently. It's either that, or build a completely parallel permissions and ownership system maintained in a separate database, with mappings per file, etc. (Samba kind of does build a parallel system, but it's not completely parallel. Technically I think it could be possible to improve, so that Samba forks off subprocesses that switch identity based on the connected user's supplied credentials interacting with PAM etc., but that's not how it's done, and I don't know enough of the details of CIFS authentication to know if there's roadblockers there.)
      - praseodym 12y ago
        Samba's smbd forks subprocesses with the connected user's account, so I think this is done whenever possible.
        12y ago
antoncohen 12y ago
This was discovered by Richard van Eeden of Microsoft Vulnerability Research (https://lists.debian.org/debian-security-announce/2015/msg00055.html https://lists.debian.org/debian-security-announce/2015/msg00...).
- Someone1234 12y ago
  https://uk.linkedin.com/in/rvaneeden https://uk.linkedin.com/in/rvaneeden
- lucb1e 12y ago
  Why are people from Microsoft looking into Linux (unix?) servers that try to emulate their services? One might think to cause reputation damage, but that sounds almost like a conspiracy theory to me... so then why do they do this effort? Edit: and the downvotes are because..?
  - illumen 12y ago
    It was probably discovered by accident when trying to get stuff working.
  - drzaiusapelord 12y ago
    Well, MS contributes to Samba http://www.zdnet.com/article/microsoft-contributes-open-source-code-to-samba/ http://www.zdnet.com/article/microsoft-contributes-open-sour... MS seems to have a financial incentive in having, at least, the file sharing part of samba working. Its probably too important to ignore, and at the time, samba was how OSX talked to Windows. I imagine making Samba work was also a move to keep OSX server from becoming an enterprise competitor. Also, I think research and netsec departments in large companies have their own priorities. Why is google finding MS vulnerabilities? I imagine a lot of this is whatever scratches the researcher's itch.
  - jgroszko 12y ago
    Microsoft's attitude towards open source is no longer adversarial. They also contribute to Mono...
  - 12y ago
th3iedkid 12y ago
Long time back when Microsoft released SMB2.0 with vista , they had a major(after having fixed another!) issue when you could send a packet with a header containing '&' negotiating an SMB connection, the remote computer would just crash with a blue screen![1] A python poC was quite out in the open . [1] https://isc.sans.edu/diary/Vista2008Windows+7+SMB2+BSOD+0Day/7093 https://isc.sans.edu/diary/Vista2008Windows+7+SMB2+BSOD+0Day...
mablae 12y ago
Is this only related to Redhat or is any smbd version affected? I am using Ubuntu for example... ?
- __david__ 12y ago
  Here's the CVE from Samba, itself: https://www.samba.org/samba/security/CVE-2015-0240 https://www.samba.org/samba/security/CVE-2015-0240 So it's not just Redhat. Debian testing/unstable currently has version 4.1.13. I assume Ubuntu will be similar. I don't see a Debian patch yet—but then again they seem to patch stable first and unstable later.

79 points by antoncohen 12y ago

AC__ 12y ago

Does the lack of comments correlate to everyone’s utter lack of surprise on this one lol?

gus_massa 12y ago
[[Just for the record, I didn't downvote you.] This is off topic, but I have read recently a few similar complains from another users. Each community has it use and customs. Here most of the people don't comment unless they have something very interesting to say or to ask. So if the article doesn't have an obvious flaw and is not polemic, you may see that it has a lot of upvotes and no comments. Also, try to avoid oneliners. It's very difficult to write good onliners and they will probably be downvoted. Explain the same idea with more words. [There is an "exception" for congratulations in post in acquisitions, marrying announcement of well known users and similar and similar happy occasions.]]
- cpncrunch 12y ago
  It could also be due to the fact that a lot of HN readers won't be affected by this issue. If you run a web server, you generally don't have samba running. You also don't generally have samba publicly accessible on your home/development network. Generally the only people with access to samba are employees in your company, so the risk is much lower than for a service that is open to the public on the internet.

drzaiusapelord 12y ago

>execution of arbitrary code as root. How the hell is this still possible in this day and age? Why is this service running as root? It really is incredible how much bad decision making goes into your typical linux distro. This should be a non-root service with an ACL on whatever files samba needs to access. It doesn't "need" to be root. Reminds me of the Windows days where every service "needed" a System or Ring0 access and every application local admin rights. Its just incredible how there's nothing between a buffer overflow (which are common and will never go away considering the languages used) and root. I wonder if SELinux could even do anything here or if samba is such a security nightmare that you just have to give it root and hope for the best. Samba is the poster child of the ugly, hacky, security questionable code that we all should be working away from, not making excuses for: http://www.cvedetails.com/vulnerability-list/vendor_id-102/Samba.html http://www.cvedetails.com/vulnerability-list/vendor_id-102/S... If you want AD, pay for AD. If you want to share files with Windows clients you have a million options nowadays. This reverse-engineered pig is just a liability and helps keep real solutions from emerging because you can just install samba and be done with it. The technical debt and liabilities here are just kicked down the road. I wonder how bad this is going to get in the world of the "internet of things" and cheap NAS's with poor firewalling being sold by the millions. edit: downvotes dont suddenly make samba a good application

throwaway2048 12y ago
Your comment demonstrates zero understanding of what samba is, or why it might need root. Hint, its tied to authenticating users and accessing their files. Granted there could be better privilege separation, and a more modular approach, but just writing it off as "why is it running as root" is like asking why does sshd need to run as root. Its just a profoundly ignorant dismissal. EDIT: parent substantially edited his comment after this was posted
- drzaiusapelord 12y ago
  If you need to be root to access Linux PAM, then linux is more fucked up than I thought. > Its just a profoundly ignorant dismissal. and its this FOSS jerk attitude that guarantees that things won't change. Linux is perfect! It cannot be criticized! sigh
  - barrkel 12y ago
    It's not just authentication, it's authorization. Files should be accessed with the identity of the remote user in order to present a consistent view of the file system, test and set permissions consistently, and set ownership consistently. It's either that, or build a completely parallel permissions and ownership system maintained in a separate database, with mappings per file, etc. (Samba kind of does build a parallel system, but it's not completely parallel. Technically I think it could be possible to improve, so that Samba forks off subprocesses that switch identity based on the connected user's supplied credentials interacting with PAM etc., but that's not how it's done, and I don't know enough of the details of CIFS authentication to know if there's roadblockers there.)
    - praseodym 12y ago
      Samba's smbd forks subprocesses with the connected user's account, so I think this is done whenever possible.
      - 12y ago

antoncohen 12y ago

This was discovered by Richard van Eeden of Microsoft Vulnerability Research (https://lists.debian.org/debian-security-announce/2015/msg00055.html https://lists.debian.org/debian-security-announce/2015/msg00...).

Someone1234 12y ago
https://uk.linkedin.com/in/rvaneeden https://uk.linkedin.com/in/rvaneeden
lucb1e 12y ago
Why are people from Microsoft looking into Linux (unix?) servers that try to emulate their services? One might think to cause reputation damage, but that sounds almost like a conspiracy theory to me... so then why do they do this effort? Edit: and the downvotes are because..?
- illumen 12y ago
  It was probably discovered by accident when trying to get stuff working.
- drzaiusapelord 12y ago
  Well, MS contributes to Samba http://www.zdnet.com/article/microsoft-contributes-open-source-code-to-samba/ http://www.zdnet.com/article/microsoft-contributes-open-sour... MS seems to have a financial incentive in having, at least, the file sharing part of samba working. Its probably too important to ignore, and at the time, samba was how OSX talked to Windows. I imagine making Samba work was also a move to keep OSX server from becoming an enterprise competitor. Also, I think research and netsec departments in large companies have their own priorities. Why is google finding MS vulnerabilities? I imagine a lot of this is whatever scratches the researcher's itch.
- jgroszko 12y ago
  Microsoft's attitude towards open source is no longer adversarial. They also contribute to Mono...
- 12y ago

th3iedkid 12y ago

Long time back when Microsoft released SMB2.0 with vista , they had a major(after having fixed another!) issue when you could send a packet with a header containing '&' negotiating an SMB connection, the remote computer would just crash with a blue screen![1] A python poC was quite out in the open . [1] https://isc.sans.edu/diary/Vista2008Windows+7+SMB2+BSOD+0Day/7093 https://isc.sans.edu/diary/Vista2008Windows+7+SMB2+BSOD+0Day...

mablae 12y ago

Is this only related to Redhat or is any smbd version affected? I am using Ubuntu for example... ?

__david__ 12y ago
Here's the CVE from Samba, itself: https://www.samba.org/samba/security/CVE-2015-0240 https://www.samba.org/samba/security/CVE-2015-0240 So it's not just Redhat. Debian testing/unstable currently has version 4.1.13. I assume Ubuntu will be similar. I don't see a Debian patch yet—but then again they seem to patch stable first and unstable later.