Samba: Authenticated users can change other users' password

loeg · on March 14, 2018

Good news: Only affects the AD / LDAP component. Bad news: That component is enabled by default. Good news: If you don't use Samba LDAP, an effective mitigation is to just disable the ldap service (search the fine article for "Disable LDAP").

cm2187 · on March 14, 2018

Does synology use samba for SMB drives?

lathiat · on March 14, 2018

Only applies to a samba domain controller, so likely not relevant

amaccuish · on March 14, 2018

If so, for this to be exploited it would not only have to be running as a AD DC, but have LDAP exposed. Valid question.

jontro · on March 14, 2018

Don't know why you're downvoted. It's a relevant question. Synology is using samba for their SMB drives, haven't found a description on how the DSM is affected.

We're using LDAP so we cannot turn that off.

NKCSS · on March 14, 2018

This is pretty major and can go right in your exploiter's toolbag for privilege escalation scenarios.

golergka · on March 14, 2018

Isn't changing someone else's password the most un-stealthy kind of exploit?

amaccuish · on March 14, 2018

Not if you change a DC password or the KRBTGT password. Then you have full control of the domain.

sebazzz · on March 14, 2018

This does not apply when the Samba server is a domain member instead of domain controller, right?

amaccuish · on March 14, 2018

correct.

jessaustin · on March 14, 2018

Haven't used samba much; this is enlightening. Previously I had assumed it just used the same auth system (e.g. PAM) as the host. That would entail its own complications but would probably have prevented this bug.

amaccuish · on March 14, 2018

It would not be possible to have an AD server using PAM, AD protocols need the NT hash.

Samba can only use PAM when plaintext passwords are used, which is not supported at all with AD (Samba as standalone requires you to store passwords in it's own database). As an Active Directory server, passwords are stored in the directory with access provided by multiple protocols. This was an issue in the LDAP ACL verification.

totony · on March 14, 2018

LDAP always has the userPassword attribute which is fully comptible with Linux, you just have to change both at the same times (this is in fact what i did for one of my clients)