OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Samba Remote Zero-Day Exploit

paul.szabosydney.edu.au
Date: Fri Feb 05 2010 - 16:43:58 CST


Dear Dan,

> The bug here is that out-of-path symlinks are remotely writable. ...

You mean "creatable".

> ... the fact that he can *generate* the symlink breaks ...

Nothing breaks if the admin sets "wide links = no" for that share: the
link is not followed.

> But Samba supports dropping a user into a path ...

I never noticed such support documented: references please?

> ... and it really does need to keep him there.

You cannot "break out" of shares with "wide links = no".

> ... Samba is supposed to match Windows semantics in general.

No please, do not dumb it down.

Cheers, Paul

Paul Szabo pszmaths.usyd.edu.au http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics University of Sydney Australia