Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Flaws In Linux SMBFS

Posted by timothy on from the or-would-you-rather-wait-for-service-pack-n dept.

An anonymous reader points out this SecurityFocus alert, which starts "The Linux kernel is reported susceptible to multiple remote vulnerabilities in the SMBFS network file system. These vulnerabilities may lead to the execution of attacker-supplied machine code, information disclosure of kernel memory, or kernel crashes, denying service to legitimate users. Versions of the kernel in both the 2.4, and the 2.6 series are reported susceptible to various issues."

18 of 347 comments (clear)

  1. It's a FEATURE by kesuki · · Score: 5, Funny

    you haven't emulated SMB unless you allow remote execution of code ;)

    --
    https://www.gnu.org/philosophy/free-sw.html
  2. this is NOT samba (smbd) by CRC'99 · · Score: 5, Informative

    It should be clarified, that this is NOT to do with the smbd process aka Samba Project - but the kernel module smbfs.o

    --
    Sendmail is like emacs: A nice operating system, but missing an editor and a MTA.
  3. MS Technology by Punboy · · Score: 4, Informative

    I'd like to point out that is a MS originated technology that only got put in Linux for compatibility with MS systems. Most Linux-only users use NFS, which does not have these security holes. Most 'secure' network environments don't even use SMB on windows machines due to security holes in the Windows implementation. My 2 cents, don't use it, its buggy and slow and suchs. On the other hand, many people need to use it in their home networks to share files between windows machines and Linux machines. My suggestion for those users is to set up a firewall which blocks SMB from the outside. And don't make samba shares on your firewall box.

    --
    If you like what I've said here, and want to read more, go to http://www.krillrblog.com
    1. Re:MS Technology by nacks1 · · Score: 5, Insightful

      "Most Linux-only users use NFS, which does not have these security holes."

      Yeah... it NFS just has plenty of holes of its own. I would be the first to say that I think that SMBFS is crap, but NFS isn't the network filesystem that we should be holding up as a good system to emulate.

    2. Re:MS Technology by geg81 · · Score: 4, Informative

      Most Linux-only users use NFS, which does not have these security holes.

      Are you kidding? From a security point of view, past versions of NFS have been an absolute disaster, far worse than SMB. You can run NFS only if you have complete trust in your network infrastructure and every single machine on it. Sun's engineers must have been on drugs when designing it.

      NFSv4 may fix some of those problems, but it hasn't been widely deployed yet, and it is far more complex than it has a right to be given its limited functionality. All network file systems for Linux currently have major problems of one kind or another (they are one of incompatible, immature, insecure, etc.).

  4. And before this goes off the front page... by Short+Circuit · · Score: 4, Interesting

    Major distributions will have patches available. Possibly even the main kernel tree.

    --
    tasks(723) drafts(105) languages(484) examples(29106)
    1. Re:And before this goes off the front page... by Alan+Hicks · · Score: 5, Informative
      <spamvertisement>
      This is old news. The 2.4.28 kernel was released with fixes for this though a 2.6.10 kernel hasn't yet been put out. I'm not sure who all has patched, but for Slackware users, you can get a 2.4.28 kernel package from SlackSec.
      </spamvertisement>
      --
      Slackware, what else when it must be secure, stable, and easy?
  5. Re:history of linux exploits by Short+Circuit · · Score: 5, Informative

    Secunia...they also have a free service where they'll email you about vulnerabilities and fixes. And I've never received spam from them. (But that may be due to my GMail account.)

    --
    tasks(723) drafts(105) languages(484) examples(29106)
  6. I'm glad this hit slashdot by Anthony+Liguori · · Score: 5, Informative

    I'll say this once, this is absolutely correct. We've known about this for a long time. SMBFS is deprecated. This is why CifsFS was written. CifsFS is a standard part of 2.6 and is available as patches for 2.4 from samba.org. CifsFS is faster, works with newer versions of Windows better, and is much more secure. More importantly, SMBFS is not being maintained. Critical bug fixes get made but that's only because it's in the kernel. Please don't use it unless you have to. Steve French is the author of CifsFS and has done a fantastic job with it.

    1. Re:I'm glad this hit slashdot by Anonymous Coward · · Score: 4, Funny

      CifsFS

      This message was brought to you by the department of redundancy department.

  7. The link doesnt actually tell you anything by Laeraun · · Score: 5, Informative

    This page gives a much better overview of what it is.

    More information also here

  8. Don't worry! by Tezkah · · Score: 5, Funny

    SP2 users are unaffected.

  9. Re:But... by flossie · · Score: 4, Informative
    Come on, I really want to know whether this allows someone to take over my machine. Besides, as an M$ hater, I want to be able to tell people 'hey, the linux kernel exploit *doesn't* allow root'. Unless, of course, it does. Does it?

    Probably not. Quote:

    While any of these vulnerabilities can be easily used as remote denial of service exploits against Linux systems, it is unclear if it is possible for a skilled local or remote attacker to use any of the possible bufferoverflows for arbitrary code execution in kernel space.

    SecurityFocus have this down as a "Design Error". Is that in the design of the implementation, or the design of the protocol? Can we start blaming Microsoft for bugs in Linux now?

    --
    flossie

    Write now. Defend liberty

  10. Re:history of linux exploits by MarsLander · · Score: 4, Informative

    The Linux Weekly News security page would be a good place to start. If you then went back and looked through the security pages of the weekly editions, you'd probably have a pretty complete database.

    http://lwn.net/security

  11. Re:history of linux exploits by Anonymous Coward · · Score: 5, Informative

    Linux advisories
    http://www.linuxsecurity.com/advisorie s/index.html

    Open Source Vunerability Database (not just for Open source software, but the database itself is open source)
    http://www.osvdb.org/

    That is probably the best and it offers vendor contact information, detailed analysis and RSS plugins.

    Secunia Security and Virus information
    http://secunia.com/

    Security Focus:
    http://www.securityfocus.com/

    So on and so forth.

  12. NOT Originally MS Technology by kmb · · Score: 5, Informative

    Microsoft did NOT in fact invent/originate SMB. IBM did.

  13. Re:Everyone makes mistakes by 13Echo · · Score: 4, Insightful

    The difference is that this is a POTENTIAL exploit. Not something that's been known for a long time but ignored to the point of mass-exploitation.

  14. smbfs -> cifs is easy by xant · · Score: 4, Informative
    I had one Linux server mounting smbfs shares from fstab on my network, running Ubuntu. The default kernel is 2.6.x and mount.cifs is included, so I found it extremely easy to convert.

    1. I was using the credentials option (-o credentials=/some/sekrit/file) and I discovered that cifs does not like spaces in this file, so I took out the spaces.
    2. I was also using the badly-named fmask and dmask options (they are not masks). Cifs has renamed these to dir_mode and file_mode, and deprecated the old usage. I renamed dmask to dir_mode and fmask to file_mode.
    3. file_mode and dir_mode expect to see a leading 0 to be interpeted as octal. I made this change.
    4. Finally I changed smbfs to cifs.

    After these minor changes that took me all of 3 minutes to make, I no longer have smbfs anywhere on this network.
    --
    It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.