Security Vulnerability in Samba (SAMBA(7)) May Allow Unauthorized Changes to Access Control Lists (ACL)

---

Security Vulnerability in Samba (SAMBA(7)) May Allow Unauthorized Changes to Access Control Lists (ACL)

1. Impact

An access control security vulnerability in the Samba (samba(7)) smbd(8) server daemon may allow a remote unprivileged user with write access to a file on a Samba server to make unauthorized changes to the file's Access Control List (ACL).

Additional information on this issue can be found in the following document:


2. Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• Solaris 9 with patch 114684-12 and without patch 114684-14
• Solaris 10 with patch 119757-13 and without patch 119757-16
• OpenSolaris based upon builds snv_96 through snv_118

x86 Platform

• Solaris 9 with patch 114685-12 and without patch 114685-14
• Solaris 10 with patch 119758-13 and without patch 119758-16
• OpenSolaris based upon builds snv_96 through snv_118

with the following versions of Samba software:

• Samba 3.0.31 through 3.0.34

Notes:

1. Solaris 8 does not include the Samba software and is therefore not affected by this issue.

2. This issue affects Samba versions 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6.

3. This issue only affects systems configured as Samba servers with 'dos filemode' option in '/etc/sfw/smb.conf' set to "yes".

To determine if a system is configured as a Samba server, the following command can be run to check for processes related to Samba:

% ps -ef | grep mbd
root   317     1   0   May 26 ?           0:01 /usr/sfw/sbin/smbd -D
root   325   317   0   May 26 ?           0:00 /usr/sfw/sbin/smbd -D
root   314     1   0   May 26 ?           0:27 /usr/sfw/sbin/nmbd -D

If the output shows 'smbd' or 'nmbd' running as a daemon (with the -D parameter), the system is configured as a Samba server.

To determine if the 'dos filemode' option is set to "yes", the following command can be run:

% grep filemode /etc/sfw/smb.conf:
dos  filemode  =  yes

If there is no 'dos filemode' option set explicitly then the default value "no" is set by default.

3. Symptoms

There are no predictable symptoms that would indicate the described issue has been exploited.

4. Workaround

To workaround the described issue, the Samba service may be configured not to use 'dos filemode' by setting this option to "no" as below:


On Solaris 9:

1. Stop the Samba service:

# /etc/init.d/samba stop

2. Modify the '/etc/sfw/smb.conf' file appropriately (as listed above)

3. Start the Samba service again:

# /etc/init.d/samba start

On Solaris 10:

1. Stop the Samba service:

# svcadm disable samba

2. Modify the '/etc/sfw/smb.conf' file appropriately (as listed above)

3. Start the Samba service again:

# svcadm enable samba

5. Resolution

This issue is addressed in the following releases:

SPARC Platform

• Solaris 9 with patch 114684-14 or later
  
• Solaris 10 with patch 119757-16 or later
• OpenSolaris based on builds snv_119 or later

x86 Platform

• Solaris 9 with patch 114685-14 or later
  
• Solaris 10 with patch 119758-16 or later
• OpenSolaris based on builds snv_119 or later

For more information on Security Sun Alerts, see Technical Instruction ID 213557.

This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements.

Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.


Modification History

29-Sep-2009: Updated Contributing Factors and Resolution sections; now Resolved

Attachments

This solution has no attachment