REDHAT-BUG-2479762: High severity Samba Samba vulnerability
Samba file servers and classic (non-AD) domain controllers offer the SamValidatePasswordChange and SamValidatePasswordReset RPC services on the SAMR DCE/RPC service when running over NCACNIPTCP. Both services pass a username and password to the "check password script" that can be configured in smb.conf.
If the "check password script" is configured with the %u substitution character, the client-controlled username is passed to the "check password script" without escaping shell meta-characters, leading to a remote command execution vulnerability.
This is a non-standard configuration in several ways:
It affects Samba file servers and classic (non-AD) domain controllers that have the "check password script" configured with the %u substitution character. Active Directory Domain Controllers are not affected, they do not expand the username via the %u substitution character.
The problem is much less dangerous if %u has single quotes directly around it, e.g. '%u', but it's still possible to inject command line options.
Standard Samba file servers and classic domain controllers are also only affected if the samba-dcerpcd service is started as a system service, which can only happen if "rpc start on demand helpers" is set to the non-default setting "no". In the default configuration for DCE/RPC, smbd starts the samba-dcerpcd in a way that makes the vulnerable code inaccessible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the non-default setting "rpc start on demand helpers" is set to "no" so that the "samba-dcerpcd" service is not started as a system service (the text states the vulnerability is only exploitable when samba-dcerpcd is started as a system service, which can happen only if this setting is set to enable it).
Samba (smb.conf) / samba-dcerpcd RPC services rpc start on demand helpers = no - Configuration
If the "check password script" is configured with "%u", modify the script or configuration so that the client-controlled username is passed to the script without expanding/allowing shell meta-character injection (the text states the issue requires "check password script" configured with %u and "without escaping shell meta-characters").
Samba (smb.conf) "check password script" %u escaping = escape shell meta-characters in the %u-substituted username - Compensating control
If possible, avoid exposing the vulnerable RPC services to untrusted clients (the text says access is over DCE/RPC running over NCACN_IP_TCP); restrict network access to the affected Samba file servers/classic domain controllers and AD DCs handling these RPC services.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2479762?
The severity of REDHAT-BUG-2479762 is classified as high with a score of 7.
What is the impact of REDHAT-BUG-2479762?
REDHAT-BUG-2479762 affects Samba file servers and classic domain controllers, potentially allowing unauthorized password change and reset operations.
How do I fix REDHAT-BUG-2479762?
To fix REDHAT-BUG-2479762, it is recommended to apply the available security updates for Samba.
What are the affected software versions for REDHAT-BUG-2479762?
REDHAT-BUG-2479762 affects certain versions of the Samba software that provide RPC services.
What services are vulnerable in REDHAT-BUG-2479762?
The vulnerable services in REDHAT-BUG-2479762 are SamValidatePasswordChange and SamValidatePasswordReset RPC services.