Category
Security
Release Phase
Resolved
Bug Id
6854988
ProductSolaris 9 Operating System
Solaris 10 Operating System
OpenSolaris
Date of Workaround Release24-Sep-2009
Date of Resolved Release29-Sep-2009
Security Vulnerability in Samba (SAMBA(7)) May Allow Unauthorized Changes to Access Control Lists (ACL)
1. Impact
An access control security vulnerability in the Samba (samba(7))
smbd(8) server daemon may allow a remote unprivileged user with write
access to a file on a Samba server to make unauthorized changes to the
file's Access Control List (ACL).
Additional information on this issue can be found in the following
document:
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
- Solaris 9 with patch 114684-12 and without patch 114684-14
- Solaris 10 with patch 119757-13 and without patch 119757-16
- OpenSolaris based upon builds snv_96 through snv_118
x86 Platform
- Solaris 9 with patch 114685-12 and without patch 114685-14
- Solaris 10 with patch 119758-13 and without patch 119758-16
- OpenSolaris based upon builds snv_96 through snv_118
with the following versions of Samba software:
- Samba 3.0.31 through 3.0.34
Notes:
1. Solaris 8 does not include the Samba software and is therefore not
affected by this issue.
2. This issue affects Samba versions 3.0.x before 3.0.35, 3.1.x and 3.2.x before 3.2.13, and 3.3.x before 3.3.6.
3. This issue only affects systems configured as Samba servers with 'dos
filemode' option in '/etc/sfw/smb.conf' set to "yes".
To determine if a system is configured as a Samba server, the following
command can be run to check for processes related to Samba:
% ps -ef | grep mbd
root 317 1 0 May 26 ? 0:01 /usr/sfw/sbin/smbd -D
root 325 317 0 May 26 ? 0:00 /usr/sfw/sbin/smbd -D
root 314 1 0 May 26 ? 0:27 /usr/sfw/sbin/nmbd -D
If the output shows 'smbd' or 'nmbd' running as a daemon (with the -D
parameter), the system is configured as a Samba server.
To determine if the 'dos filemode' option is set to "yes", the
following command can be run:
% grep filemode /etc/sfw/smb.conf:
dos filemode = yes
If there is no 'dos filemode' option set explicitly then the default
value "no" is set by default.
3. Symptoms
There are no predictable symptoms that would indicate the described
issue has been exploited.
4. Workaround
To workaround the described issue, the Samba service may be configured
not to use 'dos filemode' by setting this option to "no" as below:
dos filemode = no
On Solaris 9:
1. Stop the Samba service:
# /etc/init.d/samba stop
2. Modify the '/etc/sfw/smb.conf' file appropriately (as listed above)
3. Start the Samba service again:
# /etc/init.d/samba start
On Solaris 10:
1. Stop the Samba service:
# svcadm disable samba
2. Modify the '/etc/sfw/smb.conf' file appropriately (as listed above)
3. Start the Samba service again:
# svcadm enable samba
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
- Solaris 9 with patch 114684-14 or later
- Solaris 10 with patch 119757-16 or later
- OpenSolaris based on builds snv_119 or later
x86 Platform
- Solaris 9 with patch 114685-14 or later
- Solaris 10 with patch 119758-16 or later
- OpenSolaris based on builds snv_119 or later
For more information on
Security Sun Alerts, see 1009886.1.
This Sun Alert
notification is being provided to you on
an "AS IS"
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU
ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT
OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This
Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2009 Sun
Microsystems,
Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved.
Modification History
29-Sep-2009: Updated Contributing Factors and Resolution sections; now Resolved
References
119757-16
119758-16
114014-24
114015-24
114684-14
114685-14
AttachmentsThis solution has no attachment