Maintainers of the Samba networking utility just patched a critical code-execution vulnerability that could pose a severe threat to users until the fix is widely installed.
The seven-year-old flaw, indexed as CVE-2017-7494, can be reliably exploited with just one line of code to execute malicious code, as long as a few conditions are met. Those requirements include vulnerable computers that (a) make file- and printer-sharing port 445 reachable on the Internet, (b) configure shared files to have write privileges, and (c) use known or guessable server paths for those files. When those conditions are satisfied, remote attackers can upload any code of their choosing and cause the server to execute it, possibly with unfettered root privileges, depending on the vulnerable platform.
“All versions of Samba from 3.5.0 onwards are vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it,” Samba maintainers wrote in an advisory published Wednesday. They urged anyone using a vulnerable version to install a patch as soon as possible.
Not WCry, but close enough
The vulnerability description led researchers to speculate exploits could be “wormable.” That means they could self-replicate from vulnerable machine to vulnerable machine quickly and without requiring end users to do anything to trigger the spread. Samba was introduced in 1991 as an easier way for servers running Unix-derived operating systems to share files, printers, and other resources. Samba eventually provided the means for Unix and Linux machines to interoperate with a variety of Windows networking features, including Active Directory and Windows Server Domain. Samba 3.5.0, the version that introduced the flaw, was released in March 2010.
The vulnerability almost immediately drew comparisons to the Windows flaw that the WCry ransomware worm exploited earlier this month to