5

It was announced just yesterday that there's a new-and-serious Samba bug. Information about it can be found here:

http://www.theregister.co.uk/2017/05/25/fatthumbed_dev_slashes_samba_security/

"In CVE-2017-7494, a malicious client can "upload a shared library to a writable share, and then cause the server to load and execute it.""

On my 16.04 LTS server, I ran 'samba --version" and got back: 4.3.11

When I followed the link in the article to Samba's website, it indicates fixes for some versions, but not for Samba 4.3.11. Does anyone know when Ubuntu/Canonical will be making an update for Samba available to us?

1
  • Workaround: Add the parameter: nt pipe support = no to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.* See: samba.org/samba/security/CVE-2017-7494.html
    – Ricardo
    May 31, 2017 at 23:00

2 Answers 2

5

See CVE-2017-7494 and USN 3296-1. Fix has been released except for 17.10. The guidelines on updating are

$ sudo apt-get update
$ sudo apt-get dist-upgrade

But -when- this is released we do not know. As soon as possible is the best you can get. Though I would assume it already should ... it is seen as a "high security issue".

===

It is:

Setting up samba-vfs-modules (2:4.5.8+dfsg-0ubuntu0.17.04.2) ...

was what I got when I dist-upgraded.

2
  • 17.10 Samba is on the list of things needing attention - but that's the Development release, my guess is that CVE will be included and patched in 17.10 when that version is 'updated' properly.
    – Thomas Ward
    May 25, 2017 at 12:20
  • 1
    @Rinzwind, thanks for the quick reply. To be honest, I've used the apt-get dist-update command only once several years ago and it ended up removing a bunch of packages. The man-page for apt-get also says "The dist-upgrade command may therefore remove some packages." --So I'm hesitant to use it. As you say, it is listed a "high security issue", so I'm going to assume that they'll fix/update it very quickly. I guess I'll wait a few days... and as I only have a few PCs accessing a Samba share right now, it isn't widely visible. Thanks! May 25, 2017 at 13:11
0

Based on a suggestion I got from my post on ubuntuforums.org:

I just ran 'apt changelog samba' per suggestion and it does indeed look (if I read it correctly) it has already been patched. I simply don't remember seeing it, but I'm glad it is patched. This is what I got:

samba (2:4.3.11+dfsg-0ubuntu0.16.04.7) xenial-security; urgency=medium

  * SECURITY UPDATE: remote code execution from a writable share
    - debian/patches/CVE-2017-7494.patch: refuse to open pipe names with a
      slash inside in source3/rpc_server/srv_pipe.c.
    - CVE-2017-7494

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 19 May 2017 14:18:13 -0400

Thanks again for your help!

1
  • Upvoted since upgrading the entire distribution isn't always an option on a production server and the patch ID and bug description are matching, indicating that the bug has indeed been patched.
    – Xenhat
    Jul 25, 2017 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.