The developers of the free, open-source Samba suite of SMB/CFIS-based interoperability applications for *NIX machines issued an important patch on Wednesday, following the discovery of a remote code execution vulnerability.
All non-patched versions of Samba from 3.5.0 on up are affected by the bug, which according to a Samba vulnerability advisory allows a malicious client “to upload a shared library to a writable share, and then cause the server to load and execute it.” If the uploaded file is actually an exploit payload, this would result in remote code execution.
“To emphasise the severity and low complexity: a metasploit one-liner can be used to trigger this vulnerability,” warned Cisco's Talos threat intelligence team in a blog post on Thursday, noting that the flaw – officially designated CVE-2017-7494 – “has the potential to impact many systems around the world,” including vulnerable servers and storage devices such as NAS systems. HD Moore, developer of the Error! Hyperlink reference not valid. Framework and VP of research and development at Atredis Partners, is credited with first reporting the one-line exploit via Twitter.)
Some observers have even expressed concern that the Samba bug could be used to spread a worm similar to the WannaCry ransomware that propagated itself via a Microsoft SMB exploit called EternalBlue. However, David Baker, VP operations at Bugcrowd, suggested such fears are overblown.
“The Samba vulnerability is not a viable successor to WannaCry, given it has a much smaller surface area," said Baker, in emailed comments. "Samba has been around a long time, but it is certainly not as common as Windows architectures. Because it's a client-to-server attack that depends on additional clients to interact with the server, it's not as easy to carry out an attack on this vulnerability as it was with WannaCry, which was a client-to-client attack.”
In response to the bug, Samba has released versions 4.6.4, 4.5.10 and 4.4.14 to fix the issue and is also making patches for older Samba versions available online. Additionally, Samba has published a workaround that users can employ by adding a parameter to its software's configuration.
According to Talos researchers, bad actors are starting to grasp the potential to exploit this bug, as malicious proof-of-concept exploits begin to surface on the internet. Talos is advising users to contact their vendor to obtain patched firmware, and also “not allow direct SMB, Samba, CIFS, NFS, etc. access from the Internet to systems within their network.”