You need to patch your Samba installation as soon as possible

The major Linux distributions rolled out security fixes for a use-after-free error, tracked as CVE-2017-14746, affecting all versions of SAMBA since 4.0.

The major Linux distributions (Red Hat, Ubuntu, Debian and others) rolled out security patches for a use-after-free error, tracked as CVE-2017-14746, affecting all versions of SAMBA since 4.0.

Administrations have to apply the fixes to their distributions, another possibility consists in turning off SAMBA 1, and operation that could hide some difficulties.

According to the project’s advisory, an attacker can use a malicious SMB1 request to control the contents of heap memory via a deallocated heap pointer.

“All versions of Samba from 4.0.0 onwards are vulnerable to a use after free vulnerability, where a malicious SMB1 request can be used to control the contents of heap memory via a deallocated heap pointer. It is possible this may be used to compromise the server.” reads the advisory.

The patch to fix the issue is available at the following URL:

http://www.samba.org/samba/security/

The versions 4.7.3, 4.6.11 and 4.5.15 have been issued to address the vulnerability.

The maintainers of the project have also issued patches for older versions at:

http://samba.org/samba/patches/.

The advisory includes also a workaround, it consists in preventing SMB1 access to the server by setting the parameter:

server min protocol = SMB2

to the [global] section of your smb.conf and restart smbd.

Unfortunately, the advisory warns of problems, older clients to be unable to connect to the server.

Administrators running vulnerable versions are advised to apply the patch as soon as possible.

There is also another flaw, tracked as CVE-2017-15275, that affects all the versions from 3.6.0 onwards that has been fixed by Samba.

According to the advisory, the server may return the contents of heap allocated memory to the client revealing “password hashes or other high-value data”.

“There is no known vulnerability associated with this error, but uncleared heap memory may contain previously used data that may help an attacker compromise the server via other methods. Uncleared heap memory may potentially contain password hashes or other high-value data.” reads the advisory.

Patched versions have been made available here.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – networking, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]