bugtraq - RE: Samba Remote Zero-Day Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <B45A338323F2F44D83CE47B43E847E070109A62C5FAB@TS-SRV-003.internal.truesec.com>
Date: Tue, 9 Feb 2010 16:44:59 +0100
From: David Jacoby <David.Jacoby@...esec.se>
To: "paul.szabo@...ney.edu.au" <paul.szabo@...ney.edu.au>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: RE: Samba Remote Zero-Day Exploit

Hi FD,

This is not a zero-day vulnerability in the concept of a programmatic
Flaw. But if no one, or the majority of all Samba users never knew that
This option was available, or knew that this functionality was enabled
by default I think this problem should still be highlighted in the way
that the samba team did.

I think its good that people increase awareness of these type of problems
Because they are all over the place. Its also one of the reasons why its
So important to harden your default installation, because configuration options
Like this one tend to be enable by default.

I think it was a good finding and im glad that people are discussing it.

Best regards,
David Jacoby

-----Original Message-----
From: paul.szabo@...ney.edu.au [mailto:paul.szabo@...ney.edu.au] 
Sent: den 6 februari 2010 22:48
To: bugtraq@...urityfocus.com; full-disclosure@...ts.grok.org.uk
Subject: Re: Samba Remote Zero-Day Exploit

I find it puzzling how this discussion, including the official Samba
response

  http://www.samba.org/samba/news/symlink_attack.html

fails to consider whether the mentioned configuration (when admin sets
non-default "writeable = yes" but leaving default "wide links = yes")
allows write access to the whole filesystem (where the user has UNIX
rights). I also wonder about the interaction with the setting of "unix
extensions" (which I had set to non-default "no" to help Mac clients).

Cheers, Paul

Paul Szabo   psz@...hs.usyd.edu.au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia