Samba 4.16 release strips away more SMB 1
- Reference: 1648058409
- News link: https://www.theregister.co.uk/2022/03/23/samba_416_toctou_smb/
- Source link:
Among other changes, Samba [1]4.16 removes the SMB 1 commands that allow a client to request the server copy a file without sending it over the network, and server-side wildcard expansion. Both are rarely used, and this is the beginning of the end for accessing Samba shares from any 20th-century version of Windows. What's interesting is the complex story of why.
SMB 1 was already deprecated and off by default since Samba [2]4.11 . Although SMB over NetBEUI first appeared in LAN Manager in 1987, SMB over TCP/IP is about 30 years old. Microsoft has [3]wanted to banish it for some time. It's been [4]deprecated since 2015, but as late as XP and Windows Server 2003, it was the only version the OS understood.
[5]
SMB 2 first [6]appeared in 2007 in Vista and was updated in Windows Server 2008; since Windows Server 2012 R2 and Windows 8.1, SMB 1 has been optional – but it's still there even now. In Windows 11, you can find "SMB 1.0/CIFS File Sharing Support" in the "Turn Windows features on or off" dialog box. We do not recommend ticking it.
Years late to the SMB1-killing party, Samba finally dumps the unsafe file-sharing protocol version by default [7]READ MORE
SMB 2 is a lot [8]simpler , with 19 commands instead of over 100.
Though SMB 1 is disabled by default in today's Samba, there's an [9]ongoing effort to allow the project to be built without it entirely.
[10]
[11]
If you have some elderly NAS box or something that can't be updated and still needs SMB 1 support, it's time to replace it. Retro computing fans still gaming on Windows 98 or something might want to burn stuff onto CD, or go back to using floppies. As Windows Server 2003's end-of-life was in 2015, a year after XP extended support ended, nobody should be using them any more – but if you still are, you're probably already painfully aware of that. We look forward to [12]your future On Call and [13]Who, Me? submissions. ®
Devnote
Samba [14]4.15 , released in September, implemented functionality to finally squash a time-of-check-to-time-of-use [15]bug found in 2019.
This type of race condition can be exploited by a hostile program to change something in the time window between a program checking it and using it.
In this instance, the trick was to ask the Samba server make a new directory – for example, a new folder called clients in \\share\docs\letters\ . First the server checks that the path exists and that it's entirely within the share, that it doesn't point to elsewhere in the computer's filesystem. So long as the path is valid, Samba creates the folder.
[16]
If, in the tiny interval between checking the path and creating the folder in it, the attacker was able to change, say, letters to a symlink pointing elsewhere in the server computer's directory tree – for example, to link letters to /usr – the Samba server would happily create the new folder wherever the path now pointed to, letting the client computer access parts of the directory tree that it would not normally be allowed to see. This, for the avoidance of doubt, is bad.
The development team had to come up [17]new virtual file system code to provide a proper fix for the issue. A [18]presentation [PDF] at last year's Samba XP conference explained what they were doing, but not why they were doing it. That [19]story only became public knowledge after the issue was fixed.
Get our [20]Tech Resources
[1] https://www.samba.org/samba/history/samba-4.16.0.html
[2] https://www.samba.org/samba/history/samba-4.11.0.html
[3] https://techcommunity.microsoft.com/t5/storage-at-microsoft/stop-using-smb1/ba-p/425858
[4] https://docs.microsoft.com/en-gb/archive/blogs/josebda/the-deprecation-of-smb1-you-should-be-planning-to-get-rid-of-this-old-smb-dialect
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YjumoHdRm6F3wjBdPmGL8wAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://web.archive.org/web/20060505005515/http://blogs.msdn.com/chkdsk/archive/2006/03/10/548787.aspx
[7] https://www.theregister.com/2019/07/09/samba_sans_one_smb1/
[8] https://barreto.home.blog/2008/12/09/smb2-a-complete-redesign-of-the-main-remote-file-protocol-for-windows/
[9] https://gitlab.com/samba-team/samba/-/merge_requests/2421
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjumoHdRm6F3wjBdPmGL8wAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YjumoHdRm6F3wjBdPmGL8wAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/Tag/On%20Call/
[13] https://www.theregister.com/Tag/Who%2C%20Me%3F/
[14] https://www.samba.org/samba/history/samba-4.15.0.html
[15] https://bugzilla.samba.org/show_bug.cgi?id=13979
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjumoHdRm6F3wjBdPmGL8wAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[17] https://wiki.samba.org/index.php/The_New_VFS
[18] https://sambaxp.org/fileadmin/user_upload/sambaxp2021-slides/Boehme_The_New_VFS.pdf
[19] https://lwn.net/Articles/884052/
[20] https://whitepapers.theregister.com/
WINE anybody?
If it runs on Windows 98 it should probably run on WINE, with a few no-cd cracks here and there…
Archive history
What to do when we want to look at our computing history in a live fashion? We can archive all the current software and run in a (complex) future sandbox. We see this for even more ancient systems, which are emulated. We then also need ancient software to run for reasons of functionality and compatibility.
The question of archiving and preservation is whether it should be extended to all software. That means inclusion of the virus/malware/... software that will attack the archive and content while running in a sandbox. Maybe even an accidental inclusion of malware in the archive can create interesting scenarios for future archivists, historians and digital archeologists. We may dumb down if we do not preserve the entire history and the historians/archeologists get the wrong impressions of what actually happened.
Are we all friends now?
Microsoft used to be gleeful about how they constantly changed smb to break samba.
And Andrew Tridgell used to treat it like a crossword puzzle
Re: Are we all friends now?
I think that's a little unfair. They didn't change SMB specifically to break Samba, they just didn't care about interoperability at the time. If it worked Windows -> Windows it was done.
You're right about tridge treating it like a crossword puzzle though :-).
I see this as a good thing however over the past couple of years on my home network I had to enable it for old devices such as security cameras and media players. Sure it's a security risk but if I'm not exposing it to the internet then what's the problem? I don't use it now but what about people that do?
Symlinks are the underlying problem.
I'm planning a blistering broadside bludgeoning (as it's 'El Reg, gotta use alliterative headlines :-) on the concept of symlinks at this years SambaXP conference.
https://sambaxp.org/
(it's virtual, so you won't have to travel to Germany to attend). symlinks have ruined the POSIX filesystem API. I'm going to explain why, and talk about what can be done about it.
For those people wanting to run a Samba server for a Win98 gaming system - there is always the option to run the current version of Samba - it won't suddenly stop working. (You will want to disconnect from the internet first of course).