full-disclosure - Re: Samba Remote Zero-Day Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 5 Feb 2010 17:26:46 -0500
From: Dan Kaminsky <dan@...para.com>
To: paul.szabo@...ney.edu.au
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	kcope2@...glemail.com
Subject: Re: Samba Remote Zero-Day Exploit

The bug here is that out-of-path symlinks are remotely writable.  If a
pre-existing symlink is there, it's not a problem.  But Kingcope's bug is
legit, the fact that he can *generate* the symlink breaks the entire path
concept of SMB shares.  As long as "cd .." wasn't working, "symlink .."
mustn't either.

I agree that a user with local access should be able to generate out of path
symlinks -- there's no path constraint concept in local access (well, not
without a restricted shell, but thats its own ball of wax).  But Samba
supports dropping a user into a path, and it really does need to keep him
there.

(On a side note, you're not going to see this sort of symlink stuff on
Windows, and Samba is supposed to match Windows semantics in general.  Also,
this sort of directory traversal pops up from year to year, in web platforms
particularly, but also things like tar.)

On Fri, Feb 5, 2010 at 5:03 PM, <paul.szabo@...ney.edu.au> wrote:

> Dear Kingcope,
>
> The samba server follows symlinks by default. There are options
> ("follow symlinks", "wide links") for turning it off:
>
> http://www.samba.org/samba/docs/using_samba/ch08.html#samba2-CHP-8-SECT-1.2
>
> http://www.samba.org/samba/docs/man/manpages-3/smb.conf.5.html#FOLLOWSYMLINKS
> http://www.samba.org/samba/docs/man/manpages-3/smb.conf.5.html#WIDELINKS
>
> The "problem" at your installation seems a mis-configuration of
> your server: please ask the admin to set "secure" options.
> (Some samba installations, like mine, wish to allow same access as a
> UNIX login would allow. Some shares like [home] are provided for ease
> of use, users are encouraged to create symlinks to other "interesting"
> places e.g. NFS-mounted directories.)
>
> Cheers, Paul
>
> Paul Szabo   psz@...hs.usyd.edu.au   http://www.maths.usyd.edu.au/u/psz/
> School of Mathematics and Statistics   University of Sydney    Australia
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/