Slashdot Mirror
Newly Discovered Vulnerability Raises Fears Of Another WannaCry (reuters.com)
A newly found flaw in widely used networking software leaves tens of thousands of computers potentially vulnerable to an attack similar to that caused by WannaCry, which infected more than 300,000 computers worldwide, cybersecurity researchers said on Thursday. From a Reuters report: The U.S. Department of Homeland Security on Wednesday announced the vulnerability, which could be exploited to take control of an affected computer, and urged users and administrators to apply a patch. Rebekah Brown of Rapid7, a cybersecurity company, told Reuters that there were no signs yet of attackers exploiting the vulnerability in the 12 hours since its discovery was announced. But she said it had taken researchers only 15 minutes to develop malware that made use of the hole. "This one seems to be very, very easy to exploit," she said. Rapid7 said it had found more than 100,000 computers running vulnerable versions of the software, Samba, free networking software developed for Linux and Unix computers.
Or something with more details?
https://gcn.com/articles/2017/...
https://www.samba.org/samba/se...
This is a pretty important bug in SAMBA that, if you read the patch, all boils down to a major failure to validate user input by accepting directory paths with the "/" character in named pipes where they don't belong.
Of course, you wouldn't know that after Slashdot got done with its editorial disinformation.
AntiFA: An abbreviation for Anti First Amendment.
"I''m going to laugh my ass off when a vulnerability like this is found on Linux and you smug bastards get exploited en masse. It's just a matter of time, and I can't wait until it happens. Yay!"
Meanwhile, we commend you on your dedication to Microsoft.
I had to read till halfway through the last sentence to find out what software was actually effected.
Keep up the clickbait
you guys have such a firm grasp on what is going with computer security. amazing stuff.
This one is on Linux, but it's not as bad as the headline makes it seem. You need write access to a shared drive over Samba for it to be effective. Wannacry iirc could attack clients, not just servers, and write access wasn't necessary.
I'll be honest, if you're giving remote anonymous write access to your Samba share on the open internet, you should probably stop doing that. Figure out another way to achieve that goal.
"First they came for the slanderers and i said nothing."
If you have a SAMBA share on the open internet you should stop doing that. There are much better ways to accomplish file sharing.
If it's a SAMBA vuln, put the word "SAMBA" in your headline or, at the very least, in first line of the summary.
The Daddy casts sleep on the Baby. The Baby resists!
My favorite part is the photo caption on the reuters link:
FILE PHOTO: A hooded man holds a laptop computer as blue screen with an exclamation mark is projected on him in this illustration picture taken on May 13, 2017.
The vulnerability has a lot of prerequisites:
- You need write access to a shared
- You need to know the underlying directory structure
- You end up with a shell as user "nobody"
Sure it's bad, but it's not WannaCry bad. At best you get a shell to execute some replication code, at worst you get nothing (modern SELinux, Solaris etc refuse execution rights to nobody).
Custom electronics and digital signage for your business: www.evcircuits.com
As I understand it Wannacry only used an SMB vulnerability when it had already infected a PC via a mailed exploit. Only one employee opening an attachment could quickly infect a whole company network.
So, this one could be used in the same scenario even without having open shares on the Internet.
had found more than 100,000 computers running vulnerable versions of the software
Do you mean that there is 100,000 computers with samba exposed on internet? That is scary....
I'm sure you'll find something. In the meantime, I'm hammering away getting work done on my Win7 machine. Talk about user-friendly and bulletproof. Anyway, enjoy your malware! Toodles!
Samba is only used by Linux people when they talk to Windows machines. Take Windows out of the picture and Samba is no longer necessary. Saying that this is a problem for all Linux is like saying that a vulnerability in the Windows Linux Subsystem is a problem for all Windows users.
I use samba to make my video/audio library easily accessible for Linux machines running Kodi (readonly though). Sure I could use nfs, but samba was the easiest to setup.
The operative word in your screed is WHEN.
Have fun waiting.
A Pirate and a Puritan look the same on a balance sheet.
They'll just hand-wave it away saying "well it's fixed, you just need to update!" Ignoring, of course, lack of updates is why WannaCry spread.
...and they already appear to have a fix
This is affecting SAMBA, so that means Linux (and *BSD) boxes, but that may also include most NAS units and an awful lot of set-top boxes, streaming devices, etc. if they're accessible from Windows systems.
fencepost
just a little off
And there can be good reason for lack of updates. From the ars article on the subject today:
"Researchers with security firm Rapid7, meanwhile, said they detected 110,000 devices exposed on the Internet that appeared to run vulnerable versions of Samba. 92,500 of them appeared to run unsupported versions of Samba for which no patch was available."
That directly mirrors the windows situation in which many of the infected machines were running unsupported OS versions.
Ahh I was looking for a zealot who didn't read far enough through the article and spouted off a stereotypical "just switch to Linux!" post. But this batch of mental gymnastics is a pretty close second.
And no, its nothing like that. The amount of Linux machines that have to interact with Windows (especially in commercial environments) significantly dwarfs the number of people who use WLS. Maybe that won't always be the case, but it certainly is for now, if for no other reason than because WLS is extremely new while Samba's been around for decades.
Sure you're technically correct that its not a problem for "all" Linux machines.. but its a problem for a large enough portion of them to warrant serious concern about the threat level. Especially since, as the pundits like to point out ad nauseum, Linux has a far greater share of the market in the server room than it does on the desktop and servers are where important data tends to be stored.
Given that there's Shodan 485000 Samba servers on Linux exposing the required port directly to the internet I would say that Linux isn't free from incompetent administrators and that you're very likely to find many machines that fit just that stupid scenario you're describing.
Interestingly a large number of these severs seem to be based in the UAE. What's the bet they are related to industrial machines connected to the internet...
I have nothing to say other than if those people don't get hacked today, they'll get hacked tomorrow.
"First they came for the slanderers and i said nothing."
No it's not. You can only be attacked by people who you have given write access to your samba share.
Right, but consider how many samba machines are on small business networks. If a piece of malware gets onto any windows machine or phone attached to your network, it can potentially execute this exploit against your fileserver.
It might not be intentional. Linux distro's by default come with a whole load of server applications active; samba, avahi, cups, ntp, dhclient. The free routers provided by budget ISP's don't provide any control over the permissions of internet traffic (multicasts, protocols, ports, inbound, outbound). You can't even replace them because they are locked in to the head-end by MAC address. Insecurity baked in.
Oh great... so how many months will it be before Canonical FINALLY pushes the patched sambe out to the repo?
I begin to think of these things as evolution finally beginning to punish the dumb again. Incidentally, it does not matter whether it takes 15min, 1h, 1 day or 1 week to develop an exploit for a vulnerability. The article is dripping stupidity.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
"I'm going to laugh my ass off when a vulnerability like this is found on Linux and you smug bastards get exploited en masse. It's just a matter of time, and I can't wait until it happens. Yay!"
LOL! You obviously do not understand how Linux works. It doesn't have promiscuous "ActiveX" type controls..
Enjoy going through life without your posterior! :D
Running with Linux for over 20 years!
What is a normal update in linux? I've had to manually configure yum-cron on all my boxes. Then I need to check logwatch reports for which yum-cron ran out of memory and needs reboot. That being said, none of my boxes had Port 445 open.
A patch was available for Windows almost 2 months before the wannacry worm. Your point?
"The two most abundant elements in the universe are hydrogen and stupidity." -Harlan Ellison
Patched in Ubuntu and downstream derivatives in Samba v2:4.3.11+dfsg-0ubuntu0.16.04.7 (This is the xenial one.)
samba (2:4.3.11+dfsg-0ubuntu0.16.04.7) xenial-security; urgency=medium
* SECURITY UPDATE: remote code execution from a writable share- debian/patches/CVE-2017-7494.patch: refuse to open pipe names with a slash inside in source3/rpc_server/srv_pipe.c.
- CVE-2017-7494
-- Marc Deslauriers Fri, 19 May 2017 14:18:13 -0400
Source: http://changelogs.ubuntu.com/changelogs/pool/main/s/samba/samba_4.3.11+dfsg-0ubuntu0.16.04.7/changelog
Those that left SELinux enforcing are probably just fine (RedHat 7 CVE-2017-7494.) I've had my battles with SELinux, but I've left it enforcing. So often when I have an issue and find a solution on the Internet, step 1 is "disable SELinux". Yes, it can be a pain, but you really don't want to do that. Skip step 1.
yes because Microsoft didn't patch the bug 2 months before
idiot
It absolutely IS WannaCry bad or worse. WannaCry really was only really bad in intranet scenarios where a user runs malicious code. This is exactly the scenario you will have access to SAMBA shares with write access and plenty of common directory structures exist.
I recommend a broad ipchains rule set to allow incoming connections on a white list basis: ./ipntables -F INPUT; ./ipntables -F OUTPUT; ./ipntables -P INPUT DROP; ./ipntables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT; ./ipntables -A INPUT -p tcp --dport 80 -j ACCEPT; ./ipntables -A INPUT -i lo -j ACCEPT; ./ipntables -A OUTPUT -o lo -j ACCEPT;
iptables -A INPUT -p icmp -j ACCEPT;
ip6tables -A INPUT -p icmpv6 -j ACCEPT;
iptables -A INPUT -p udp -m udp --dport 67 -j ACCEPT;
iptables -A INPUT -p udp -m udp --dport 68 -j ACCEPT;
ip6tables -A INPUT -p udp -m udp --dport 546 -j ACCEPT ./ipntables -A INPUT -j DROP
ip6tables -A INPUT -p udp -m udp --dport 547 -j ACCEPT
Where ipntables is a shell script that calls both ip6tables and iptables with with arguments.
Nobody at UK NHS confirmed if it was indeed an e-mailed exploit. The source could be malvertising (malicious ads) in websites or through the IME-AMT feature of Intel CPU's.
You're going to laugh your ass off when a vulnerability is found on thousands of computers and that vulnerability leads to an exploit that...cripples websites you use? ...causes thousands of computers to attack your computer? ...causes losses to you or someone/something you cherish? That isn't very smart at all.
NFS is much easier to set up (single line config and start the service) and works better with kodi... I can't imagine going to the trouble of installing samba for a scenario like this.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
And many of these will also be too old to contain the vulnerability...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
The free routers provided by budget ISP's don't provide any control over the permissions of internet traffic
Which budget ISPs give the machines behind the router public IP addresses by default?
The free routers provided by budget ISP's don't provide any control over the permissions of internet traffic
Which budget ISPs give the machines behind the router public IP addresses by default?
Comcast (though I debate them being referred to as a "budget" ISP).
You'll get a whole /48 assigned to you. Not sure how well their filter ingress v6 traffic at their edges.
"It might not be intentional. Linux distro's by default come with a whole load of server applications active; samba, avahi, cups, ntp, dhclient."
Please list one linux distro that installs and enables smbd by default.
The rest are not server-only software, cups is usually configured to listen on yhe loopback interface, and avahi and ntpd normally run as non-root
So the biggest risk is the dhcp client. One wonders if it is necessary for the dhcp client to listen all the time these days. Of course it should be possible to write a dhxp client that drops privs and requires the minimum capabilities to configure network interfaces.
Of course, all of these are optional, and you would only lose the feature provided by the service if you disable it, and updates won't re-enable anything you have disabled (unlike on Windows).
So, I don't think we willl see the same level of exploitation.
I have a similar setup.
Why?
Kodi profiles.
I have one Kodi instance, running as one unix user, but if the Kids profile is logged in, there is no way to access non-child-apprpriate content.
When the master profile logs in to Kodi, the samba shares are used, accessed by username/password.
Yes, it is not secure, but enougj to keep kids under 9 away from stuff they probably don't need to hear/see.
And, due to the nature of NFS, not so easy to do (since NFS perma apply bu unix uid or other similar proxy e.g uid with access to kerberos tgt).
If there is a samba-less solution, I would like to hear it, since I have no Windows in my house.
I worked for an enterprise until recently.
Our team ran about 200 VMs.
About 4 ran Windows, the rest Linux (RHEal7 mostly).
About 2 of the Linux VMs had Samba (to store common large software packages used by developers). The shares weren't writable eccept by system administrators, and the underlying filesystems mounted noexec. SELinux set to enforcing.
It's not like it wpuld be a burden to patch those, and lots of mitigations if exploited before someone does patch them.
So your idea that 'Linux in the enterprise runs Samba' needs a qualifier.
So your idea that 'Linux in the enterprise runs Samba' needs a qualifier.
I keep forgetting that on Slashdot you always have to explicitly state the qualifier: "all generalizations have exceptions." In most settings that's just a given.