![]() ![]() Administrators are advised to focus on testing and deploying the patch to remediate the vulnerability. While the vendor has also advised removing the fruit VFS module from the vfs objects lines as a workaround, this can severely affect macOS systems attempting to access stored information in the server. ![]() Patches were released in January, and administrators are advised to apply the applicable updates as soon as possible. ![]() How can the Samba vulnerability be mitigated? The company’s vendor list shows that the potential sectors affected by this security concern include critical industries such as communications, energy, government, manufacturing, and science and technology, as well as consumer devices such as appliances and internet of things (IoT) devices. Network-attached storage (NAS) devices are also likely affected by this vulnerability and vendors are expected to release updates for their respective devices. In addition, security releases to correct the said gap have been issued for Samba 4.13.17, 4.14.12, and 4.15.5, advising administrators to upgrade these releases and apply the patch immediately. Samba also announced that this vulnerability affects all versions of Samba prior to 4.13.17. Samba has released the source code patch for this gap, along with the other vulnerabilities disclosed to them. As stated in the vendor’s advisory, if the options in the default configurations of vfs_fruit are set to settings other than the preselected option, the system is unaffected by the vulnerability. This implementation is a freely available fileserver implementation of the Apple Filing Protocol (AFP) serving Apple devices. This is also enabled by default to allow file sharing and interoperability between available devices, particularly the open source implemented NetaTalk. While the analyzed version was smbd 4.9.5, which is not the latest version, a few vendors incorporate this and earlier versions of the server daemon in their products as was seen in the Pwn2Own 2021 event. An attacker can abuse this vulnerability to execute code in the root context even without authentication. The specific gap exists in the parsing of the EA metadata in the server daemon smbd when opening a file. This allows network administrators to configure, integrate, and set up equipment either as a domain controller (DC) or domain member, and to communicate with Windows-based clients.ĬVE-2021-44142 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Samba. It runs on most Unix and Unix-like systems such as Linux and macOS systems, among other versions and operating systems (OS) that use the SMB/Common Internet File System (CIFS) protocol. What is Samba? Samba is a standard interoperability software suite integrated in Windows, a reimplementation of the server message block (SMB) networking protocol for file and print services. ![]() Trend Micro customers are protected and can follow manual workarounds to address this issue. Samba has released all the relevant patches to mitigate the impact of the threats that can abuse this gap. If abused, this security gap can be used by remote attackers to execute arbitrary code as root on all affected installations that use the virtual file system (VFS) module vfs_fruit. While we have not seen any active attacks exploiting this vulnerability, CVE-2021-44142 received a CVSS rating of 9.9 out of the three variants reported. ZDI looked further into the security gap and found more variants of the vulnerability after the event and subsequently disclosed the findings to the company. Update as of February 8, 2022: To help identify vulnerable endpoints and/or servers, you may use our recently published assessment tool to scan for the Samba vulnerability.Īn earlier version of an out-of-bounds (OOB) vulnerability in Samba was disclosed via Trend Micro Zero Day Initiative’s ( ZDI) Pwn2Own Austin 2021. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |