Samba Server, used popularly for Linux is found to be critically vulnerable to Remote Code Execution vulnerability. Samba is the most commonly used Windows interoperability suite of programs, used by Linux and Unix systems. The vulnerability is recently disclosed on Samba's official website mentioning the vulnerability with CVE id as CVE-2015-0240. The affected versions are found to be Samba 3.5.0 to 4.2.0rc4. According to Trend Micro researchers this Samba Server Vulnerability is said to be difficult to exploit and also any successful exploitation is not yet detected. Originally, Richard van Eeden of Microsoft Vulnerability Research found this vulnerability and also with a potential fix for the Samba server Vulnerability.

About the Vulnerability

Unauthenticated code execution attack smbd file services

Trend Micro researchers came up with below intersting facts about this Samba Server vulnerability:

1. The vulnerability resides in the Netlogon Remote Protocol implementation of Samba which is a very high-level application protocol that can be used over different transports configurations.
2. To execute the vulnerable code the attacker doesn't need be authenticated and can use many ways to launch the attacks because of the previous point. This is very motivating for attackers as they can find ways to bypass Intrusion Prevention System (IPS).

In Simpler words

A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet could allow execution of arbitrary code. This code would execute with root privileges.

Technical Details

The method NetrServerPasswordSet is implemented in _netr_ServerPasswordSet() in the source file sambasource3 pc_server etlogonsrv_netlog_nt.c. The  creds pointer is passed into netr_creds_server_step_check() without initialization. The following figure shows the vulnerable code section:Further an analysis on redhat security blog reveals, The triggering conditions can be different for Samba v3 and Samba v4. control computer_name and credentials to reach the vulnerable code section making this vulnerability as possibly exploitable. In Depth Technical details can be found here. Also a public POC (Proof-of-Concept) is published on Github. Trend Micro researchers found that on Running this POC and doing dynamic analysis shows that effectively the method _netr_ServerPasswordSet is called. The following figure shows the resumed call graph of Samba.After this stage, Trend Micro researchers explained thoroughly about the attack vectors and the exploitation of this samba server vulnerability.

Attack Mechanisms

The Netlogon Remote Protocol is a very high level application protocol that can run on different protocol stack configurations. The following figure shows it.

Conclusion

It is at the end concluded that this particular Samba Server Vulnerability can be exploited in the wild as it is very complex. But Since the Samba servers are used more than often in the Linux servers worldwide, it is a serious threat for the system admins. Hence, the system admins are advised to apply the patches and update Samba to the latest release.

Mitigation

Samba acted swiftly and have released the patch addressing the defect. Additionally, Samba 4.2.0rc5, 4.1.17, 4.0.25 and 3.6.25 have been issued as security releases to correct the defect. Also a workaround is suggested by Samba, On Samba versions 4.0.0 and above, add the line: rpc_server:netlogon=disabled to the [global] section of your smb.conf. For Samba versions 3.6.x and earlier, this workaround is not available.