Slashdot Mirror
Samba Exploit Discovered, Fixed
An anonymous reader submits: "Digital Defense reported a remote root vulnerability in Samba that has existed in Samba source code for over 8 years. If it hadn't been caught from a wild packet capture, who knows how many more years it might have gone on. Fixes for this, and at least three other vulnerabilities have been fixed today. This is a serious threat to many thousands of people.. Did you plan to spend your Monday upgrading to Samba 2.2.8a?"
elijahao supplies some more information: "All stable versions are affected (2.x), but the 3.0 series is not. Here is a link to the News page. Check out a mirror near you to get the Source or Security patches from 2.2.7a, 2.2.8, or 2.0.10."
"Okay everybody... ... you know the drill. Pitchforks ready! "
Whoah, slow down there buddy. We gotta check the list.
-Microsoft? No.
-RIAA/MPAA? No.
-IBM? No.
-Amazon? No.
-TurboTax? No.
Sorry, Samba's not on the list. Turn in your pitchfork for a song of praise.
"Derp de derp."
I thought Monday was Patch Your Microsoft Server days... SAMBA is allowed Thursday, or was that...Wednesday...? I forget....
A FreeBSD Security Advisory has been issued and the samba port has been updated to the fixed version:
:)
samba 2.2.8a
Update 2.2.8 -> 2.2.8a.
Submitted by: dwcjr (MAINTAINER)
I already updated my installation 4 hours ago, the FreeBSD folk are fast
This is what is fixed by the update:
(1) Sebastian Krahmer of the SuSE Security Team identified
vulnerabilities that could lead to arbitrary code execution as root,
as well as a race condition that could allow overwriting of system
files. (This vulnerability was previously fixed in Samba 2.2.8.)
(2) Digital Defense, Inc. reports: ``This vulnerability, if exploited
correctly, leads to an anonymous user gaining root access on a Samba
serving system. All versions of Samba up to and including Samba 2.2.8
are vulnerable. Alpha versions of Samba 3.0 and above are *NOT*
vulnerable.''
Well, Samba is supposed to make a Unix computer look and act like a Windows server, right? In that case, it could be argued that a remote root exploit is a feature.
Disclaimer: The opinions expressed are not necessarily my own, as I've not yet had my medication today.
This sort of thing could never have happened if it was Open Source! Thousands of people would have reviewed the source code to make sure that there were no problems like this.
Oh wait...
I think it's better that these bugs are found, publicized and patched in a professional manner (like Samba, Sendmail, etc.) then see a company sit on an exploit for a while and state that their products are unbreakable (Oracle) or secure (Microsoft)... even if it's a bug a day. So long as it's fixed, people are notified about it.
As far as people patching them, that's another topic altogether.
Almost every software has bugs... be it disclosed or not disclosed.
Actually I have been thinking about this very fact w.r.t.
these recent vulnerabilities.
The problem was that the written code *worked*, as in if
it was given well-formed SMB packets it behaved correctly,
even though it was in a little used part of the code.
Because it worked 'out of the box' as it were, with
Windows clients there was little reason to examine it.
It's code that has a problem that gets looked at first.
I'm not trying to absolve myself of blame, after all, I
wrote the buggy code, but there was a reason that no one
needed to look at it for 8 years or so.
Jeremy Allison,
Samba Team.
"Did you plan to spend your Monday upgrading to Samba 2.2.8a?"
/root
/end monday rant
No, I spent monday yelling at people trying to explain to them "WHY" they need to updgrade. Dumb S.A.'s.
Low and behold an intern sysadmin tells me "Looks like someone has a case of the mondays!"
...It's ok...just wait until he sees me put his pink slip in his
Rob
Yes, Apple are working on this. I ported the fix to
their codebase this morning and mailed it to them.
Jeremy Allison,
Samba Team.
Here's Hoping the Modierators don't
.sig at the bottom of
actually read this closely. See, there's
this dude named Jeremy Allison, one of the
nice people who writes code for Samba.
I've used Samba for years - I've used
to replace or prevent about 20 Microsft
Windows Instalations over the last few years.
But by mimicking Jeremy's layout style
and putting his
this post - I just might get some undeserved
Karma.
Let's see if it works.
Jeremy Allison,
Samba Team.
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
Well, as I posted above, I think the reason no one
looked at the code is because it worked as written
with the most common clients (Microsoft ones).
We, the Linux vendors and just about everyone else
who uses Samba audits the code regularly, but this
one got missed by everyone but the bad guys. Sometimes
that happens. Life just *sucks* sometimes.
Everytime we get a problem we always go through and
look for instances of this class of problem (that's
how I spent my weekend) but I'm afraid no code is
perfect.
Jeremy Allison,
Samba Team.
Open source provides the opportunity for many eyes to audit the code. It does not guarantee that it will happen.
On the bright side, if Samba weren't open source, we might never have found this problem at all, and the fix would not have come so soon after the flaw was discovered.
We had a fix within 1 hour of the problem being
reported, and that was mainly due to mail propagation
delays from Australia ! We had to co-ordinate the
release with all the Samba vendors, that's what took
the time.
Your point about code auditing is incorrect. No company
pays the sort of money needed to do the amount of code
auditing a major OSS project gets *for free* by the
vendor community. Yes, they could do this, but proprietary
software companies simply don't spend the money on engineering
resources to be used in this way. Not even Microsoft.
Jeremy Allison,
Samba Team.
Conspiracy theory: He created this bug because he's a karma whore!! :)
I think the thing that intrests me the most about this bug is how it was found. Does anyone have more information on what brought this bug to light?
:)
:) I would be curious if it's a configuration problem (although tech support dosen't seem to think so) or a real bug.
In a related subject people here need to lay off the samba developers. They are doing a great job at admiting the problem and taking responbility for it. Heck just today I discovered a bug with LinkSys Wireless Router/Switches relating to multicast. I called their tech support folks only to get promissed a call back after we had covered the basic configuration toubles. It is now almost 6:00pm my time, no call back. No accountability with these people. I wasn't even given the persons contact information nor was I given any time they might call me back.
Compare that with OSS....I can remeber countless occasions being frustrated with a piece of software only to discover I had accually uncovered a bug. One simple e-mail to the author and I had a patch along with the stern instructions to e-mail him back if there where any more problems.
No I am not microsoft/novell/apple bashing, I just feel that OSS comes out with more accountibility for their products. Perhaps I would hear back more often from commerical companies if I bought 500 copies of their product a month. But the same goes for about anything that isn't grassroots. Perhaps I just need more money
Zorton
btw: if anyone with a linksys BEFW11S4 switch can broadcast on any multicast IP and not have it lock up let me know