{"id":45106,"date":"2022-02-02T00:00:00","date_gmt":"2022-02-02T00:00:00","guid":{"rendered":"urn:uuid:ef9bcaaf-27a4-5a31-ea80-29562262921d"},"modified":"2022-02-02T00:00:00","modified_gmt":"2022-02-02T00:00:00","slug":"the-samba-vulnerability-what-is-cve-2021-44142-and-how-to-fix-it","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/the-samba-vulnerability-what-is-cve-2021-44142-and-how-to-fix-it\/","title":{"rendered":"The Samba Vulnerability: What is CVE-2021-44142 and How to Fix It"},"content":{"rendered":"

<\/p>\n

<\/div>\n

An earlier version of an out-of-bounds (OOB) vulnerability in Samba was disclosed via Trend Micro Zero Day Initiative\u2019s (ZDI<\/a>) Pwn2Own Austin 2021<\/a>. ZDI looked further into the security gap and found more variants<\/a> of the vulnerability after the event and subsequently disclosed the findings to the company. While we have not seen any active attacks exploiting this vulnerability, CVE-2021-44142<\/a> received a CVSS rating of 9.9 out of the three variants reported. If abused, this security gap can be used by remote attackers to execute arbitrary code as root on all affected installations that use the virtual file system (VFS) module vfs_fruit<\/i>. Samba has released all the relevant patches to mitigate the impact of the threats that can abuse this gap. Trend Micro customers are protected<\/a> and can follow manual workarounds to address this issue.<\/p>\n

What is Samba?<\/span>Samba<\/a> is a standard interoperability software suite integrated in Windows, a reimplementation of the server message block (SMB) networking protocol for file and print services. It runs on most Unix and Unix-like systems such as Linux and macOS systems, among other versions and operating systems (OS) that use the SMB\/Common Internet File System (CIFS) protocol. This allows network administrators to configure, integrate, and set up equipment either as a domain controller (DC) or domain member, and to communicate with Windows-based clients.<\/p>\n

What is CVE-2021-44142?<\/span><\/p>\n

CVE-2021-44142 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Samba. The specific gap exists in the parsing of the EA metadata in the server daemon smbd<\/i> when opening a file.  An attacker can abuse this vulnerability to execute code in the root context even without authentication.<\/p>\n

While the analyzed version was smbd 4.9.5, which is not the latest version, a few vendors incorporate this and earlier versions of the server daemon in their products as was seen in the Pwn2Own 2021<\/a> event. This is also enabled by default to allow file sharing and interoperability between available devices, particularly the open source implemented NetaTalk<\/a>. This implementation is a freely available fileserver implementation of the Apple Filing Protocol (AFP) serving Apple devices. As stated in the vendor\u2019s advisory<\/a>, if the options in the default configurations of vfs_fruit are set to settings other than the preselected option, the system is unaffected by the vulnerability.<\/p>\n

Who and what are likely affected?<\/span><\/p>\n

Samba has released the source code patch<\/a> for this gap, along with the other vulnerabilities disclosed to them. Samba also announced that this vulnerability affects all versions of Samba prior to 4.13.17. In addition, security releases to correct the said gap have been issued for Samba 4.13.17, 4.14.12, and 4.15.5, advising<\/a> administrators to upgrade these releases and apply the patch immediately. Network-attached storage (NAS) devices are also likely affected by this vulnerability and vendors are expected to release updates for their respective devices. The company\u2019s vendor list<\/a> shows that the potential sectors affected by this security concern include critical industries such as communications, energy, government, manufacturing, and science and technology, as well as consumer devices such as appliances and internet of things (IoT) devices.<\/p>\n

How can the Samba vulnerability be mitigated?<\/span><\/p>\n

Patches were released<\/a> in January, and administrators are advised to apply the applicable updates as soon as possible. While the vendor has also advised removing the fruit VFS module from the vfs objects lines as a workaround, this can severely affect macOS systems attempting to access stored information in the server. Administrators are advised to focus on testing and deploying the patch to remediate the vulnerability. ZDI also advises that many different vendors will need to update their version to ship with affected devices (such as NAS devices), so the release of additional patches can be expected.<\/p>\n

Has Samba been abused for attacks?<\/span><\/p>\n

Earlier versions of Samba, such as 3.6.3 and lower, have reported security concerns<\/a> that allow unauthorized users to gain root access from an anonymous connection by exploiting Samba\u2019s remote procedure call<\/a>. Other disclosures have also been done before:<\/p>\n