Wormable WannaCry Type Vulnerability for Linux & Unix with Samba

FrgMstr

FrgMstr

Just Plain Mean
Staff member
2FA
Joined
May 18, 1997
Messages
58,681
I know we have a lot of HardOCP readers that use Linux systems at home, and if you use the Samba networking utility, now is the time to pay attention.

A newly found flaw in widely used networking software leaves tens of thousands of computers potentially vulnerable to an attack similar to that caused by WannaCry, which infected more than 300,000 computers worldwide, cybersecurity researchers said on Thursday.

If you have not patched up very recently, you should do so now. Reuters is pointing out that most folks running the Samba software are home users, and very likely using older versions of the software that can NOT be patched. And according to this Twitter post, there is not a whole lot to getting the exploit running, so be careful with your traffic.

Samba is aware of this and has issued this warning, CVE-2017-7494.html:

A patch addressing this defect has been posted to

http://www.samba.org/samba/security/

Additionally, Samba 4.6.4, 4.5.10 and 4.4.14 have been issued as
security releases to correct the defect. Patches against older Samba
versions are available at http://samba.org/samba/patches/. Samba
vendors and administrators running affected versions are advised to
upgrade or apply the patch as soon as possible.

==========
Workaround
==========

Add the parameter:

nt pipe support = no

to the [global] section of your smb.conf and restart smbd. This
prevents clients from accessing any named pipe endpoints. Note this
can disable some expected functionality for Windows clients.
 
The difference being even if someone was to exploit this good luck encrypting my system (not that many home type users are running samba in general)... the fix has already been pushed and done. To exploit this in the same way as the recent Wcry you would need another 2-3 exploits to combo up with this one. Not to say there aren't more vulnerabilities... of course their are. Of course if someone where to try and weaponize this one, their target list would be really small (not that samba isn't used a lot in nice juicy database targets) most samba users are likely already patched. It pays having a proper method of updating.
 
I noticed an update come through my Mint machine last night for Samba. Wonder if it was a fix for this vulnerability. Will have to check when I get home.
 
ChadD said:
The difference being even if someone was to exploit this good luck encrypting my system (not that many home type users are running samba in general)... the fix has already been pushed and done. To exploit this in the same way as the recent Wcry you would need another 2-3 exploits to combo up with this one. Not to say there aren't more vulnerabilities... of course their are. Of course if someone where to try and weaponize this one, their target list would be really small (not that samba isn't used a lot in nice juicy database targets) most samba users are likely already patched. It pays having a proper method of updating.
Click to expand...

While running a modern Linux distribution likely means you are patched (though for that matter, everyone running supported Windows versions should have been patched for WCry), the real issue is all of the cheapo NAS products on the market. Most of these use a mini-distribution of Linux that will likely not be patched. For numbers, Ars reported yesterday that there's 477k systems publicly exposed and findable via a search engine. While you personally might be largely immune to this, it really is a large issue. Just saying "it's Linux!" doesn't automatically mean that everything that is broken will be fixed in a timely fashion.
 
Paladin21 said:
..... the real issue is all of the cheapo NAS products on the market. Most of these use a mini-distribution of Linux that will likely not be patched.
Click to expand...

I checked for my Synology NAS and:

Version: 6.1.1-15101-4
(2017/05/25)

Important Note

  1. The update is expected to be available for all regions within the next few days, although the time of release in each region may vary slightly.
Fixed Issues

  1. Fixed a security vulnerability regarding samba service (CVE-2017-7494).
Click to expand...
 
I fully expected Synology and Qnap to have point releases for this up and running in a compressed time frame, so that's no surprise. What I'm talking about are all the barely- to non-supported systems from 2nd and 3rd tier vendors. Junk like bottom-of-the-barrel modem/router combos from ISPs, NAS systems from vendors like Buffalo, and IoT junk like no-name security systems. These are the sorts of devices where updates are uncertain, and installation of updates by users is even more of a guess.
 
Paladin21 said:
While running a modern Linux distribution likely means you are patched (though for that matter, everyone running supported Windows versions should have been patched for WCry), the real issue is all of the cheapo NAS products on the market. Most of these use a mini-distribution of Linux that will likely not be patched. For numbers, Ars reported yesterday that there's 477k systems publicly exposed and findable via a search engine. While you personally might be largely immune to this, it really is a large issue. Just saying "it's Linux!" doesn't automatically mean that everything that is broken will be fixed in a timely fashion.
Click to expand...

I know what your saying. Ya security is an issue for every OS. I have faith though that this will solve itself update wise pretty quickly, unlike windows users Linux folk tend to actually update.

As you say they found 477k samba enabled machines with port 445 exposed... that still doesn't mean they are running vulnerable versions of samba. Of the 477k detected only 100k or so where determined to have vulnerable versions. It is possible many of those are older NAS hardware that may not be as easily patched. We'll see how it shakes out... but the vulnerability although bad no doubt still isn't exploitable in the same way as the recent windows issue, unless someone is holding on to a DoublePulsar level linux kernel sploit. I'm sure the majority of the NAS vendors will release proper updates, hopefully older gear doesn't get left behind.
 
ChadD said:
I know what your saying. Ya security is an issue for every OS. I have faith though that this will solve itself update wise pretty quickly, unlike windows users Linux folk tend to actually update.
Click to expand...

With about 1.5 billion Windows PCs and 300k reported infections of WannaCry, something tells me that plenty of people and organizations update Windows regularly. Say only 10% of Windows 7 machines didn't patch for this, that's something around 70 million machines that were vulnerable. Had been most of all 700 million, I think WannaCry would have been FAR, FAR worse.
 
heatlesssun said:
With about 1.5 billion Windows PCs and 300k reported infections of WannaCry, something tells me that plenty of people and organizations update Windows regularly. Say only 10% of Windows 7 machines didn't patch for this, that's something around 70 million machines that were vulnerable. Had been most of all 700 million, I think WannaCry would have been FAR, FAR worse.
Click to expand...

The number of unpatched windows 7 machines is likely far higher then 10%. Not every vulnerable machine was on a network open to this attack. Not every vulnerable machine was infected. In the case of this samba vulnerability it hasn't been exploited as far as anyone knows, and to do any real dmg would likely need another exploit. Anyway its been pointed out and fixed.

People get worked up a lot... the truth is their are a ton of major flaws in every piece of software in use today, they just haven't been pointed out yet. My favorite recent exploit was the $110,000 hack at pwn2own last month by 360 security... they had Win 10 running in a VM, they broke out of edges sandbox in the VM, took kernel control of the VM OS.... exploited a buffer overflow exploit in VMware got to the host OS and popped its kernel as well. Thankfully the best money these days is in finding stuff like that rather then using it. :)
 
ChadD said:
The number of unpatched windows 7 machines is likely far higher then 10%.
Click to expand...

Perhaps, we definitely had this patch deployed long ago, I'm guessing any good large enterprise IT organization had it done as well, everyone should understand the implications of a remote execution flaw.

ChadD said:
People get worked up a lot... the truth is their are a ton of major flaws in every piece of software in use today, they just haven't been pointed out yet. My favorite recent exploit was the $110,000 hack at pwn2own last month by 360 security... they had Win 10 running in a VM, they broke out of edges sandbox in the VM, took kernel control of the VM OS.... exploited a buffer overflow exploit in VMware got to the host OS and popped its kernel as well. Thankfully the best money these days is in finding stuff like that rather then using it. :)
Click to expand...

All non-trivial software has flaws. Like you say it's just a matter of finding them.
 
  • Like
Reactions: ChadD
like this
How can you guys possibly think this is not as bad as the windows exploit just because the port isn't publicly exposed.... Not sharing files over the internet really saved those windows machines right?.... The only real difference is windows has SMB enabled by default, where samba is not on linux. All it takes is 1 idiot to bring it into an internal network and it would spread exactly the same, assuming someone used the exploit to run similar malicious code...
 
Biznatch said:
How can you guys possibly think this is not as bad as the windows exploit just because the port isn't publicly exposed.... Not sharing files over the internet really saved those windows machines right?.... The only real difference is windows has SMB enabled by default, where samba is not on linux. All it takes is 1 idiot to bring it into an internal network and it would spread exactly the same, assuming someone used the exploit to run similar malicious code...
Click to expand...

Well a Linux system is still not going to let a worm do much once it gains access via samba. Its a major security hole obviously... but no its not Eblue level, and no one has advertised a DoubleP level hack to combo with it. :)

Within a few days 99% of the samba running machines will be patched. Most NAS products will have official patches... those that don't get official patches can add the line "nt pipe support = no" to smb.conf not the ideal solution but I imagine all but a handful of devices will be getting firmware patches.
 
Gentoo's GLSA has this now

https://forums.gentoo.org/viewtopic-t-1064056.html

If you use Samba, see https://www.samba.org/samba/security/CVE-2017-7494.html

Testing branch samba-4.5.10 has been patched to address this vulnerability but as of this writing has not been stabilized.

Workaround: Add
Code: 
nt pipe support = no
to the [global] section of your /etc/samba/smb.conf file and restart the samba service.
Click to expand...

CVE:
Additionally, Samba 4.6.4, 4.5.10 and 4.4.14 have been issued as
security releases to correct the defect. Patches against older Samba
versions are available at http://samba.org/samba/patches/. Samba
vendors and administrators running affected versions are advised to
upgrade or apply the patch as soon as possible.
Click to expand...

Code: 
[ebuild     U  ] net-fs/samba-4.5.10::gentoo [4.5.9::gentoo] USE="acl client pam winbind -addc -addns -ads -cluster -cups -dmapi -fam -gnutls -gpg -iprint -ldap -quota (-selinux) -syslog (-system-heimdal) -system-mitkrb5 -systemd {-test} -zeroconf" ABI_X86="32 (64) (-x32)" PYTHON_TARGETS="python2_7" 20,498 KiB
[ebuild     U  ] sci-electronics/kicad-4.0.6::gentoo [4.0.5::gentoo] USE="examples github python -debug -doc -i18n -libressl -minimal" L10N="-bg% -ca% -cs% -de% -el% -es% -fi% -fr% -hu% -it% -ja% -ko% -nl% -pl% -pt% -ru% -sk% -sl% -sv% -zh-CN%" LINGUAS="(-bg%) (-ca%) (-cs%) (-de%) (-el%) (-es%) (-fi%) (-fr%) (-hu%) (-it%) (-ja%) (-ko%) (-nl%) (-pl%) (-pt%) (-ru%) (-sk%) (-sl%) (-sv%) (-zh_CN%)" PYTHON_TARGETS="python2_7" 186,804 KiB

update pulled in and samba restarted. Ill check my ubuntu box at work 1st thing & if samba isn't updated ill apply the block



goo opensource for such fast fixes
 
What happened to people running an older, but frequently updated, release, like Ubuntu 12.04 LTS or Ubuntu 14.04 LTS? Did they get the fix with normal, routine updating methods?
 
the_servicer said:
What happened to people running an older, but frequently updated, release, like Ubuntu 12.04 LTS or Ubuntu 14.04 LTS? Did they get the fix with normal, routine updating methods?
Click to expand...

Samba isn't part of the kernel or any core files. So ya it should be updated just fine if they are still getting updates. If someone is running a Linux distro without a PM update setup... they could always download the tar ball from samba. Absolute worse case if its an embedded product or something they can edit the smb.conf file adding the line "NT pipe support = no".
 
the_servicer said:
What happened to people running an older, but frequently updated, release, like Ubuntu 12.04 LTS or Ubuntu 14.04 LTS? Did they get the fix with normal, routine updating methods?
Click to expand...

I posted this zdnet.com link, "Canonical extends Ubuntu 12.04 support for paying customers", in another forum a few days ago. Since Ubuntu 12.04 LTS is no longer receiving updates unless the business has bought an Extended Service Maintenance license one can only hope that the users still using it are routinely updating.
 
Bleh, someone beat me to the joke I suppose, nevermind. :D
 
ChadD said:
I know what your saying. Ya security is an issue for every OS. I have faith though that this will solve itself update wise pretty quickly, unlike windows users Linux folk tend to actually update.

As you say they found 477k samba enabled machines with port 445 exposed... that still doesn't mean they are running vulnerable versions of samba. Of the 477k detected only 100k or so where determined to have vulnerable versions. It is possible many of those are older NAS hardware that may not be as easily patched. We'll see how it shakes out... but the vulnerability although bad no doubt still isn't exploitable in the same way as the recent windows issue, unless someone is holding on to a DoublePulsar level linux kernel sploit. I'm sure the majority of the NAS vendors will release proper updates, hopefully older gear doesn't get left behind.
Click to expand...

On the enterprise side that would not necessarily be the case, for critical systems you usually don't update right away, you give time time to first test the patches on the staging or development environment (be it windows or linux or any other system). so patches usually take a month or two to go live. and to be honest I wont be surprised if this was the case with the windows patch affecting large enterprises. I for one would update anything ASAP (be it windows or linux) personally. But at work, I would really be careful as a lot of things tend to break easily.
 
dyzophoria said:
On the enterprise side that would not necessarily be the case, for critical systems you usually don't update right away, you give time time to first test the patches on the staging or development environment (be it windows or linux or any other system). so patches usually take a month or two to go live. and to be honest I wont be surprised if this was the case with the windows patch affecting large enterprises. I for one would update anything ASAP (be it windows or linux) personally. But at work, I would really be careful as a lot of things tend to break easily.
Click to expand...

That is fair... I don't think it would or will be a big issue for pure Linux houses, most full nix setup houses don't tend to sit on updates nearly as long. For mixed setups using Samba I think your likely quite right many do delay updates for test sometimes as much as a few months. (still many will do security updates quicker when they are warned about something like this or the wcry stuff) With this particular bug it can be temporarily fixed at least with one line added to the smb.conf file until they decided to roll out the proper fix... if they really insist on testing the security patch. I get your point though. The larger the setup the less likely people are doing daily updates no matter the OS.
 
"dyzophoria said: ↑
On the enterprise side that would not necessarily be the case, for critical systems you usually don't update right away, you give time time to first test the patches on the staging or development environment (be it windows or linux or any other system). so patches usually take a month or two to go live. and to be honest I wont be surprised if this was the case with the windows patch affecting large enterprises. I for one would update anything ASAP (be it windows or linux) personally. But at work, I would really be careful as a lot of things tend to break easily.
That is fair... I don't think it would or will be a big issue for pure Linux houses, most full nix setup houses don't tend to sit on updates nearly as long. For mixed setups using Samba I think your likely quite right many do delay updates for test sometimes as much as a few months. (still many will do security updates quicker when they are warned about something like this or the wcry stuff) With this particular bug it can be temporarily fixed at least with one line added to the smb.conf file until they decided to roll out the proper fix... if they really insist on testing the security patch. I get your point though. The larger the setup the less likely people are doing daily updates no matter the OS."

...just spit balling here, but; "on the enterprise side" is where Microsoft believes they have the cash cow by the balls, while in the mean time trying to forcibly leverage ( non-commercial) consumer entities into that other (bubble)cash flow known as data telemetry(that apple , google and facebook already have bag in hand) known as w10.
 
naib said:
update pulled in and samba restarted. Ill check my ubuntu box at work 1st thing & if samba isn't updated ill apply the block



goo opensource for such fast fixes
Click to expand...


So it looks like they are putting out patches for older versions, but their wording on the site isn't clear. I checked Mint with Synaptic and can see they did patch version 4.3.x even though Samba's notes say they only released security updates for versions 4.4 and higher. So thankfully it looks like Ubuntu 16.04LTS should have or is getting a patch, as it is also based on 4.3.x. I don't have anything to check that is 14.04 to see if samba v4.1.x is getting a patch or if you just need to use a work around.
 
heatlesssun said:
It's a seven year old flaw. Not dissing the response time but it just points out that flaws are a matter of finding them.
Click to expand...
Which has just been found ..

The windows flaw is even older by your logic (XP... maybe even Win2k). The difference is it was public knowledge nov-2016 and wasnt patched till mar-2017

See the difference or you still thinking MS can do not wrong. How are those group policies for Telemetry going
 
Last edited:
Biznatch said:
How can you guys possibly think this is not as bad as the windows exploit just because the port isn't publicly exposed.... Not sharing files over the internet really saved those windows machines right?.... The only real difference is windows has SMB enabled by default, where samba is not on linux. All it takes is 1 idiot to bring it into an internal network and it would spread exactly the same, assuming someone used the exploit to run similar malicious code...
Click to expand...

This is nothing like Wannacry and I struggle to even call the issue an exploit as such. It looks like functionality that was included in Samba at some stage (seven years ago) to allow easier setup of Samba shares over the internet to Windows machines - See what happens when us Linux users try to co operate with Windows machines! ;) The biggest problem is that the named pipe doesn't necessarily close when the process ends, instead staying open as long as the machine is up. Furthermore, by the looks of things the named pipes are all stored on the root filesystem.

I wonder though, who has port 445 open to the internet? I know I sure as shit don't and that 'exploit' (more like feature) is hammering SMB port 445. There's also the issue of delivering the payload as Linux doesn't automatically open attachments in emails.

The other difference is that the second this exploit was noticed, people were notified and it was patched - Good job open source developers, MS could take some pointers as this is literally textbook exploit handling.

fTsH8vr.png
 
Last edited:
  • Like
Reactions: ChadD
like this
heatlesssun said:
And all I was saying is that all non-trivial software has bugs, it's simply a matter of finding them.
Click to expand...
Which is why I also stated DO-178 should be applied to the like of commercial software. requirements, validated requirements, top down & bottom up review, code review, implementation review, SOI audits.
non-trivial just means you need a process in place to really really test stuff
 
All the Linux users in here deflecting and making excuses sounds like Hillary trying to make up excuses for losing the presidential election. The smugness is palpable.
 
naib said:
Which is why I also stated DO-178 should be applied to the like of commercial software. requirements, validated requirements, top down & bottom up review, code review, implementation review, SOI audits.
non-trivial just means you need a process in place to really really test stuff
Click to expand...

No testing process is perfect because you can't every test input and system configuration possibility in complex, non-trivial system.
 
Armenius said:
All the Linux users in here deflecting and making excuses sounds like Hillary trying to make up excuses for losing the presidential election. The smugness is palpable.
Click to expand...

Its not smugness. Its just pointing out facts. When the Linux people identified this one and made it clear everyone should patch... or change a setting until this is patched for security reasons. Some windows users said look look see our OS isn't the only bad one. Accept the windows flaw was baked into windows itself. This flaw is in Samba, a cross platform file and print sharing service, that happens to mainly be used by Linux users. Mom and Pop Linux users don't have Samba servers up and running... who would be the only users who would have a machine on the internet with SMB ports open. Yes researchers did find a bunch of vulnerable Samba servers on the net day one... they are almost all NAS hardware units likely plugged into home and small business machines that have exposed ports.

So this is not Wcry level as some web reports claim...
1) this isn't a Linux vul its a Samba file server software vul.
2) effected exposed machines can be protected as simply as typing "nt pipe support = no" into Sambas smb.conf.
3) Linux's open source community rolled out a complete fix quicker then it takes MS to acknowledge a bug report
4) every major Linux distro pushed the updated Samba versions within a day or two
5) this flaw is not being exploited by active malware... we are at the point MS was at back in March when knowledge of Eblue and Dpulsar was released. No one is claiming MS didn't react and patch their OS, however somehow months later many windows users still hadn't applied such a major security patch... which points to something wrong with the entire process.

So no deflection... this was a bad security flaw no doubt. It just wasn't anything close to being on the level of the Eblue windows SMB hole that effected every copy of Windows 7 / Vista / XP. It was a flaw in an open source package, that when found was fixed and updates where rolled out within a few days.... their is simply no way in 3 months from now someone is going to be able to introduce a worm based on this bug and have it spread anywhere.
 
Armenius said:
All the Linux users in here deflecting and making excuses sounds like Hillary trying to make up excuses for losing the presidential election. The smugness is palpable.
Click to expand...

The procedure used for finding the offending code was literally textbook, the offending code was found and patched before it could be used, before it could cause any damage. As a Linux user, if I'm smug it's because the scenario in question highlights perfectly the benefit of open source when finding and patching code added seven years ago in an attempt to allow easier setup of Samba shares over the internet to Windows machines before it could be used as an exploit.
 
You must log in or register to reply here.
Back
Top