5

It was announced just yesterday that there's a new-and-serious Samba bug. Information about it can be found here:

http://www.theregister.co.uk/2017/05/25/fatthumbed_dev_slashes_samba_security/

"In CVE-2017-7494, a malicious client can "upload a shared library to a writable share, and then cause the server to load and execute it.""

On my 16.04 LTS server, I ran 'samba --version" and got back: 4.3.11

When I followed the link in the article to Samba's website, it indicates fixes for some versions, but not for Samba 4.3.11. Does anyone know when Ubuntu/Canonical will be making an update for Samba available to us?

Improve this question
1
  • Workaround: Add the parameter: nt pipe support = no to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.* See: samba.org/samba/security/CVE-2017-7494.html
    – Ricardo
    May 31, 2017 at 23:00

2 Answers 2

Reset to default
5

See CVE-2017-7494 and USN 3296-1. Fix has been released except for 17.10. The guidelines on updating are

$ sudo apt-get update
$ sudo apt-get dist-upgrade

But -when- this is released we do not know. As soon as possible is the best you can get. Though I would assume it already should ... it is seen as a "high security issue".

===

It is: 

Setting up samba-vfs-modules (2:4.5.8+dfsg-0ubuntu0.17.04.2) ...

was what I got when I dist-upgraded.

Improve this answer
2
  • 17.10 Samba is on the list of things needing attention - but that's the Development release, my guess is that CVE will be included and patched in 17.10 when that version is 'updated' properly.
    – Thomas Ward ♦
    May 25, 2017 at 12:20
  • 1
    @Rinzwind, thanks for the quick reply. To be honest, I've used the apt-get dist-update command only once several years ago and it ended up removing a bunch of packages. The man-page for apt-get also says "The dist-upgrade command may therefore remove some packages." --So I'm hesitant to use it. As you say, it is listed a "high security issue", so I'm going to assume that they'll fix/update it very quickly. I guess I'll wait a few days... and as I only have a few PCs accessing a Samba share right now, it isn't widely visible. Thanks!
    – David Allie
    May 25, 2017 at 13:11
0

Based on a suggestion I got from my post on ubuntuforums.org:

I just ran 'apt changelog samba' per suggestion and it does indeed look (if I read it correctly) it has already been patched. I simply don't remember seeing it, but I'm glad it is patched. This is what I got:

samba (2:4.3.11+dfsg-0ubuntu0.16.04.7) xenial-security; urgency=medium

  * SECURITY UPDATE: remote code execution from a writable share
    - debian/patches/CVE-2017-7494.patch: refuse to open pipe names with a
      slash inside in source3/rpc_server/srv_pipe.c.
    - CVE-2017-7494

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 19 May 2017 14:18:13 -0400

Thanks again for your help!

Improve this answer
1
  • Upvoted since upgrading the entire distribution isn't always an option on a production server and the patch ID and bug description are matching, indicating that the bug has indeed been patched.
    – Xenhat
    Jul 25, 2017 at 19:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .