Bugtraq mailing list archives
Re: Samba Remote Zero-Day Exploit
From: Dan Kaminsky <dan () doxpara com>
Date: Sat, 6 Feb 2010 12:43:28 -0500
You need admin rights to create junctions. At that point, path constraints aren't relevant, just psexec and get not only arbitrary path but arbitrary code.
The fix is to do what everybody with a directory traversal bug has to do, block out of path relative directories. In this specific case, prevent the creation of symlinks where the target is out of the SMB share's range. (Still allow navigation to such symlinks if one exists, though.)
On Feb 6, 2010, at 8:21 AM, "Stefan Kanthak" <stefan.kanthak () nexgo de> wrote:
Dan Kaminsky wrote: [...](On a side note, you're not going to see this sort of symlink stuff onWindows,What exactly do you mean?Traversing symlinks on the server/share, or creation of "wide" symlinksby the client on the server/share?Since Windows 2000 NTFS supports "junctions", which pretty much resembleUnix symlinks, but only for directories. See <http://support.microsoft.com/kb/205524/en-us> On the server, create a junction in your share and let it point to an arbitrary local directory outside the share, and clients connected to that share can enter the junction and access the "linked" directory. If you have write access to the share from the client you can createa "wide" junction there too, just as the OP showed with smbclient/ samba.and Samba is supposed to match Windows semantics in general.Except a mapping of directory symlinks to junctions for example.-( Stefan
Current thread:
- Re: [Full-disclosure] Samba Remote Zero-Day Exploit, (continued)
- Re: [Full-disclosure] Samba Remote Zero-Day Exploit Thierry Zoller (Feb 08)
- Re: Samba Remote Zero-Day Exploit Kingcope (Feb 08)
- Re: Samba Remote Zero-Day Exploit paul . szabo (Feb 08)
- Re: Samba Remote Zero-Day Exploit paul . szabo (Feb 08)
- RE: Samba Remote Zero-Day Exploit David Jacoby (Feb 09)
- Re: Samba Remote Zero-Day Exploit paul . szabo (Feb 08)
- Message not available
- Re: Samba Remote Zero-Day Exploit Stefan Kanthak (Feb 08)
- RE: Samba Remote Zero-Day Exploit Michael Wojcik (Feb 08)
- Re: Samba Remote Zero-Day Exploit Stefan Kanthak (Feb 09)
- RE: Samba Remote Zero-Day Exploit Michael Wojcik (Feb 09)
- Message not available
- Re: Samba Remote Zero-Day Exploit Dan Kaminsky (Feb 08)
- Re: Samba Remote Zero-Day Exploit Stefan Kanthak (Feb 08)
- Re: Samba Remote Zero-Day Exploit Dan Kaminsky (Feb 08)
- Re: [Full-disclosure] Samba Remote Zero-Day Exploit paul . szabo (Feb 08)
- Re: [Full-disclosure] Samba Remote Zero-Day Exploit Krzysztof Halasa (Feb 09)