February 3, 2022
Samba has fixed a vulnerability in all versions of software prior to 4.13.17 that allowed a remote actor to execute code as root due to an out-of-bounds heap read-write vulnerability.
“The specific flaw exists within the parsing of EA metadata when opening files in smbd. Access as a user that has write access to a file’s extended attributes is required to exploit this vulnerability,” Samba said in its security notice.
Originally recognized by Orange Tsai from Devcore and referred to as CVE-2021-44142, Samba said that the vfs _ fruit module, which improves compatibility for OS X clients, was vulnerable in its default configuration.
If the options fruit:metadata=netatalk or fruit:resource=file are set to something else, the vulnerability will not work, but doing so comes with a caveat.
“Changing the VFS module settings fruit:metadata or fruit:resource to use the unaffected setting causes all stored information to be inaccessible and will make it appear to macOS clients as if the information is lost,” said Samba.
Samba, therefore, recommends the preferred remedy for patches, which is to remove fruit from the configuration.
Versions 4.13.17, 4.14.12, and 4.15.5 of Samba were recently introduced to mitigate the problem. While traditional desktop and server users can upgrade via normal processes, NAS systems, especially older ones, will have to wait for possible firmware upgrades.
For more information read the original story in ZDNet.
