Slashdot Mirror
Newly Discovered Vulnerability Raises Fears Of Another WannaCry (reuters.com)
A newly found flaw in widely used networking software leaves tens of thousands of computers potentially vulnerable to an attack similar to that caused by WannaCry, which infected more than 300,000 computers worldwide, cybersecurity researchers said on Thursday. From a Reuters report: The U.S. Department of Homeland Security on Wednesday announced the vulnerability, which could be exploited to take control of an affected computer, and urged users and administrators to apply a patch. Rebekah Brown of Rapid7, a cybersecurity company, told Reuters that there were no signs yet of attackers exploiting the vulnerability in the 12 hours since its discovery was announced. But she said it had taken researchers only 15 minutes to develop malware that made use of the hole. "This one seems to be very, very easy to exploit," she said. Rapid7 said it had found more than 100,000 computers running vulnerable versions of the software, Samba, free networking software developed for Linux and Unix computers.
Or something with more details?
I'm going to laugh my ass off when a vulnerability like this is found on Linux and you smug bastards get exploited en masse. It's just a matter of time, and I can't wait until it happens. Yay!
https://gcn.com/articles/2017/...
https://www.samba.org/samba/se...
This is a pretty important bug in SAMBA that, if you read the patch, all boils down to a major failure to validate user input by accepting directory paths with the "/" character in named pipes where they don't belong.
Of course, you wouldn't know that after Slashdot got done with its editorial disinformation.
AntiFA: An abbreviation for Anti First Amendment.
Newly Discovered Vulnerability Raises Fears
OMG FEAR! WE'RE ALL GOING TO DI..what? It's in a Linux software package?
Um...well....apt-get update && apt-get dist-upgrade....*whew* that didn't take any time at all...what should I be scared about now?
I had to read till halfway through the last sentence to find out what software was actually effected.
Keep up the clickbait
If it's a SAMBA vuln, put the word "SAMBA" in your headline or, at the very least, in first line of the summary.
The Daddy casts sleep on the Baby. The Baby resists!
My favorite part is the photo caption on the reuters link:
FILE PHOTO: A hooded man holds a laptop computer as blue screen with an exclamation mark is projected on him in this illustration picture taken on May 13, 2017.
had found more than 100,000 computers running vulnerable versions of the software
Do you mean that there is 100,000 computers with samba exposed on internet? That is scary....
...and they already appear to have a fix
This is affecting SAMBA, so that means Linux (and *BSD) boxes, but that may also include most NAS units and an awful lot of set-top boxes, streaming devices, etc. if they're accessible from Windows systems.
fencepost
just a little off
During a normal update. Unlike Windows, Linux is on top of things.
Oh great... so how many months will it be before Canonical FINALLY pushes the patched sambe out to the repo?
I begin to think of these things as evolution finally beginning to punish the dumb again. Incidentally, it does not matter whether it takes 15min, 1h, 1 day or 1 week to develop an exploit for a vulnerability. The article is dripping stupidity.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Patched in Ubuntu and downstream derivatives in Samba v2:4.3.11+dfsg-0ubuntu0.16.04.7 (This is the xenial one.)
samba (2:4.3.11+dfsg-0ubuntu0.16.04.7) xenial-security; urgency=medium
* SECURITY UPDATE: remote code execution from a writable share- debian/patches/CVE-2017-7494.patch: refuse to open pipe names with a slash inside in source3/rpc_server/srv_pipe.c.
- CVE-2017-7494
-- Marc Deslauriers Fri, 19 May 2017 14:18:13 -0400
Source: http://changelogs.ubuntu.com/changelogs/pool/main/s/samba/samba_4.3.11+dfsg-0ubuntu0.16.04.7/changelog
Those that left SELinux enforcing are probably just fine (RedHat 7 CVE-2017-7494.) I've had my battles with SELinux, but I've left it enforcing. So often when I have an issue and find a solution on the Internet, step 1 is "disable SELinux". Yes, it can be a pain, but you really don't want to do that. Skip step 1.
I recommend a broad ipchains rule set to allow incoming connections on a white list basis: ./ipntables -F INPUT; ./ipntables -F OUTPUT; ./ipntables -P INPUT DROP; ./ipntables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT; ./ipntables -A INPUT -p tcp --dport 80 -j ACCEPT; ./ipntables -A INPUT -i lo -j ACCEPT; ./ipntables -A OUTPUT -o lo -j ACCEPT;
iptables -A INPUT -p icmp -j ACCEPT;
ip6tables -A INPUT -p icmpv6 -j ACCEPT;
iptables -A INPUT -p udp -m udp --dport 67 -j ACCEPT;
iptables -A INPUT -p udp -m udp --dport 68 -j ACCEPT;
ip6tables -A INPUT -p udp -m udp --dport 546 -j ACCEPT ./ipntables -A INPUT -j DROP
ip6tables -A INPUT -p udp -m udp --dport 547 -j ACCEPT
Where ipntables is a shell script that calls both ip6tables and iptables with with arguments.