Slashdot Mirror
Samba Exploit Discovered, Fixed
An anonymous reader submits: "Digital Defense reported a remote root vulnerability in Samba that has existed in Samba source code for over 8 years. If it hadn't been caught from a wild packet capture, who knows how many more years it might have gone on. Fixes for this, and at least three other vulnerabilities have been fixed today. This is a serious threat to many thousands of people.. Did you plan to spend your Monday upgrading to Samba 2.2.8a?"
elijahao supplies some more information: "All stable versions are affected (2.x), but the 3.0 series is not. Here is a link to the News page. Check out a mirror near you to get the Source or Security patches from 2.2.7a, 2.2.8, or 2.0.10."
... you know the drill. Pitchforks ready!
I thought Monday was Patch Your Microsoft Server days... SAMBA is allowed Thursday, or was that...Wednesday...? I forget....
A FreeBSD Security Advisory has been issued and the samba port has been updated to the fixed version:
:)
samba 2.2.8a
Update 2.2.8 -> 2.2.8a.
Submitted by: dwcjr (MAINTAINER)
I already updated my installation 4 hours ago, the FreeBSD folk are fast
This is what is fixed by the update:
(1) Sebastian Krahmer of the SuSE Security Team identified
vulnerabilities that could lead to arbitrary code execution as root,
as well as a race condition that could allow overwriting of system
files. (This vulnerability was previously fixed in Samba 2.2.8.)
(2) Digital Defense, Inc. reports: ``This vulnerability, if exploited
correctly, leads to an anonymous user gaining root access on a Samba
serving system. All versions of Samba up to and including Samba 2.2.8
are vulnerable. Alpha versions of Samba 3.0 and above are *NOT*
vulnerable.''
Your wife is cheating on you... It wouldn't have been a problem, but you just HAD to hire a Private Investigator...
Well, Samba is supposed to make a Unix computer look and act like a Windows server, right? In that case, it could be argued that a remote root exploit is a feature.
Disclaimer: The opinions expressed are not necessarily my own, as I've not yet had my medication today.
This sort of thing could never have happened if it was Open Source! Thousands of people would have reviewed the source code to make sure that there were no problems like this.
Oh wait...
The Samba site actually mentions that an active exploit is already out there. Hopefully most people are running Samba in hard-to-reach places, but this definitely is a large problem. This is one I wouldn't let slide for more than oh, say... the next 30 minutes.
I think its a good thing. Instead of these bugs being found by the "wrong" people these are found and fixed before anyone can mess up production systems. This, if anything, shows the strength of OSS. It gets fixed quickly.
I think it's better that these bugs are found, publicized and patched in a professional manner (like Samba, Sendmail, etc.) then see a company sit on an exploit for a while and state that their products are unbreakable (Oracle) or secure (Microsoft)... even if it's a bug a day. So long as it's fixed, people are notified about it.
As far as people patching them, that's another topic altogether.
Almost every software has bugs... be it disclosed or not disclosed.
Actually I have been thinking about this very fact w.r.t.
these recent vulnerabilities.
The problem was that the written code *worked*, as in if
it was given well-formed SMB packets it behaved correctly,
even though it was in a little used part of the code.
Because it worked 'out of the box' as it were, with
Windows clients there was little reason to examine it.
It's code that has a problem that gets looked at first.
I'm not trying to absolve myself of blame, after all, I
wrote the buggy code, but there was a reason that no one
needed to look at it for 8 years or so.
Jeremy Allison,
Samba Team.
"Did you plan to spend your Monday upgrading to Samba 2.2.8a?"
/root
/end monday rant
No, I spent monday yelling at people trying to explain to them "WHY" they need to updgrade. Dumb S.A.'s.
Low and behold an intern sysadmin tells me "Looks like someone has a case of the mondays!"
...It's ok...just wait until he sees me put his pink slip in his
Rob
Yes, Apple are working on this. I ported the fix to
their codebase this morning and mailed it to them.
Jeremy Allison,
Samba Team.
Rebuilding this for a second time this week on a 25mhz machine almost makes me want to upgrade to a faster CPU.
Here's Hoping the Modierators don't
.sig at the bottom of
actually read this closely. See, there's
this dude named Jeremy Allison, one of the
nice people who writes code for Samba.
I've used Samba for years - I've used
to replace or prevent about 20 Microsft
Windows Instalations over the last few years.
But by mimicking Jeremy's layout style
and putting his
this post - I just might get some undeserved
Karma.
Let's see if it works.
Jeremy Allison,
Samba Team.
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
Well, as I posted above, I think the reason no one
looked at the code is because it worked as written
with the most common clients (Microsoft ones).
We, the Linux vendors and just about everyone else
who uses Samba audits the code regularly, but this
one got missed by everyone but the bad guys. Sometimes
that happens. Life just *sucks* sometimes.
Everytime we get a problem we always go through and
look for instances of this class of problem (that's
how I spent my weekend) but I'm afraid no code is
perfect.
Jeremy Allison,
Samba Team.
I can only speak for myself, but I'd much prefer the Samba team to pore over the code looking for more bugs like this, than adding catch-up-with-the-gateses features like NT Domain Controller support which are largely irrelevant.
Some of the recent features (BDC support via LDAP, good domain membership via winbind) are the only things that allow people to run a more secure SMB server than Windows. Without those features, we would have to cave in and run something that has them. If samba did not have domain controlling support, we would likely not be running any linux boxen now, whereas most of our servers do at present.
The Unix philosophy is to do one thing, and do it well, and Samba already does this. If we want central authentication, we have a host of packages we can already choose from.
Anything that can *really* compete with AD and NDS? I think not (and yes, we run LDAP, including samba backended on LDAP, and are implementing kerberos).
Open source provides the opportunity for many eyes to audit the code. It does not guarantee that it will happen.
On the bright side, if Samba weren't open source, we might never have found this problem at all, and the fix would not have come so soon after the flaw was discovered.
We had a fix within 1 hour of the problem being
reported, and that was mainly due to mail propagation
delays from Australia ! We had to co-ordinate the
release with all the Samba vendors, that's what took
the time.
Your point about code auditing is incorrect. No company
pays the sort of money needed to do the amount of code
auditing a major OSS project gets *for free* by the
vendor community. Yes, they could do this, but proprietary
software companies simply don't spend the money on engineering
resources to be used in this way. Not even Microsoft.
Jeremy Allison,
Samba Team.
The problem is that there are 20,000 different people with access to these servers, both administrative and student, and you really can't trust all of them not to try to r00t your b0>.
Conspiracy theory: He created this bug because he's a karma whore!! :)
Well, there is actually a difference.
It might have taken eight years for someone to notice the bug and release a security advisory. However, once that was done, it only took the developers a week to release a patch.
Had it been in a Microsoft product, it would have taken a week to get a security advisory, and eight years to get the patch.
Attack its weak point for massive damage!
We had a fix within 1 hour of the problem being reported, and that was mainly due to mail propagation delays from Australia ! We had to co-ordinate the release with all the Samba vendors, that's what took the time.
I'm not sure it really matters why the delay occurred - maybe that's something to work on for next time. Even if the fix could not be released immediately, it may have been a good idea to alert people that a problem existed so they could take additional precautions while the coordination efforts were taking place.
No company pays the sort of money needed to do the amount of code auditing a major OSS project gets *for free* by the vendor community
Releasing the source does not guarantee that anybody will actually perform a code audit. Neither does writing proprietary code. I don't claim like you do to know if they do so or not, but companies like Microsoft certainly have the resources to hire people to do audits and security reviews if they want to. This is more than most OSS projects can say.
Maybe you could set up a system so that the people in the community who you say are doing these reviews for free could document what parts of the code they have reviewed. That way we would know what parts have been looked at the most or least, and look at the track record of the people doing the reviews.
I think the thing that intrests me the most about this bug is how it was found. Does anyone have more information on what brought this bug to light?
:)
:) I would be curious if it's a configuration problem (although tech support dosen't seem to think so) or a real bug.
In a related subject people here need to lay off the samba developers. They are doing a great job at admiting the problem and taking responbility for it. Heck just today I discovered a bug with LinkSys Wireless Router/Switches relating to multicast. I called their tech support folks only to get promissed a call back after we had covered the basic configuration toubles. It is now almost 6:00pm my time, no call back. No accountability with these people. I wasn't even given the persons contact information nor was I given any time they might call me back.
Compare that with OSS....I can remeber countless occasions being frustrated with a piece of software only to discover I had accually uncovered a bug. One simple e-mail to the author and I had a patch along with the stern instructions to e-mail him back if there where any more problems.
No I am not microsoft/novell/apple bashing, I just feel that OSS comes out with more accountibility for their products. Perhaps I would hear back more often from commerical companies if I bought 500 copies of their product a month. But the same goes for about anything that isn't grassroots. Perhaps I just need more money
Zorton
btw: if anyone with a linksys BEFW11S4 switch can broadcast on any multicast IP and not have it lock up let me know