The name of the attribute must not be within the private Samba attribute name list, which includes user.SAMBA_PAI, user.DOSATTRIB, user.SAMBA_STREAMS, and security.NACL. This is done by the set_ea function found in “source3/smbd/trans2.c”. Once a session is established, smbd allows an unauthenticated user to set extended file attributes of a file via SMB2_SET_INFO.
It allows Unix-like systems to serve as file servers for Apple devices. Netatalk is an open-source implementation of the Apple Filing Protocol (AFP). The fruit module that ships with Samba is designed to provide interoperability between Samba and Netatalk. If both options are set to different settings than the default values, the system is not affected by the security issue.” As stated by the vendor advisory, “The problem in vfs_fruit exists in the default configuration of the fruit VFS module using fruit:metadata=netatalk or fruit:resource=file.
The bugs we’re concerned with reside in the fruit module, which provides enhanced compatibility with Apple SMB clients. The vfs objects list contains three modules: catia, fruit, and streams_xattr. In this section, you can see that guest ok = yes is declared, which allows guest authentication. Much of this information was derived from the white paper submitted by STARLabs as a part of their Pwn2Own entry. Now that the patch has been made available, let’s take a more detailed look at the bugs involved and the patch released to fix them. An attacker can leverage this vulnerability to execute code in the context of root. The specific flaw exists within the parsing of EA metadata in the Samba server daemon (smbd) when opening a file. Authentication is not required to exploit this vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samba. This bug was also independently reported to Samba by Orange Tsai of DEVCORE. After the event, Lucas Leong of Trend Micro Zero Day Initiative discovered additional variants of the vulnerability which were disclosed to Samba as part of this fix. This vulnerability was disclosed at Pwn2Own Austin 2021 by Nguyễn Hoàng Thạch ( Billy Jheng Bing-Jhong ( STAR Labs.
Recently, Samba released a patch to address an Out-of-Bounds (OOB) Heap Read/Write vulnerability found in Samba versions prior to 4.13.17.
0 kommentar(er)
