Vulnerability in Samba made us share what we did not want to share

Samba on Kubuntu

Probably those who read Samba for the first time in a blog about Ubuntu / Linux you are thinking of a dance, but no. In computing, it is a free implementation of the Windows file sharing protocol that basically allows us to share files and folders from one computer to another. When it works well, we can simply see / show what others want us to see / want us to see from our teams, but it wasn't working as well as it should.

Stefan Metzmacher found that the Samba SMB server did not prevent clients from escaping out of the root share directory in some situations. This could be used by an attacker to access files outside the sharing zone, that is, of what we had configured as "Shared" through Samba. Simply put, a knowledgeable user could access practically any file on our computer if it was connected to the same network.

Samba vulnerability only affected Ubuntu 19.04

As usual, Canonical made public this failure when has corrected it. Vulnerability was the CVE-2019-10197, of medium urgency, and it affected Ubuntu 19.04 Disco Dingo. It continues to affect Ubuntu 19.10 Eoan Ermine, but in this case we are talking about an operating system that has not even reached the beta phase (will do it on September 26).

Although the update that I applied in Kubuntu included more files, Canonical says that it is necessary to update samba - 2: 4.10.0 + dfsg-0ubuntu2.4 on the aforementioned Ubuntu 19.04. The update will appear in the different software centers, like Discover in Kubuntu / KDE neon, or in Software Update on systems like standard Ubuntu. Once the patches are applied, we must restart for the changes to take effect.

For those who have this doubt and as we can see in the Miter report, the bug is not unique to Ubuntu; it's a Samba bug. But the good thing about using a distribution with a great company behind it is, among other things, that the fixes come before.


Leave a Comment

Your email address will not be published. Required fields are marked with *

*

*

  1. Responsible for the data: Miguel Ángel Gatón
  2. Purpose of the data: Control SPAM, comment management.
  3. Legitimation: Your consent
  4. Communication of the data: The data will not be communicated to third parties except by legal obligation.
  5. Data storage: Database hosted by Occentus Networks (EU)
  6. Rights: At any time you can limit, recover and delete your information.