Re: [Full-disclosure] Samba Remote Zero-Day Exploit



From: Stefan Kanthak [mailto:stefan.kanthak@xxxxxxxx]
Sent: Saturday, 06 February, 2010 08:21

Dan Kaminsky wrote:

[...]

(On a side note, you're not going to see this sort of symlink stuff
on Windows,

What exactly do you mean?
Traversing symlinks on the server/share, or creation of "wide"
symlinks
by the client on the server/share?

Since Windows 2000 NTFS supports "junctions", which pretty much
resemble Unix symlinks, but only for directories.
See <http://support.microsoft.com/kb/205524/en-us>

And at least since Vista, it also supports symlinks, which are designed
to mimic Unix symlinks, and can point to files or directories. Junctions
and symlinks can cross volumes; symlinks can also refer to files or
directories on network filesystems.

Junctions (which Microsoft also sometimes refers to as "soft links") and
symlinks are implemented with NTFS reparse points, just like mounts. You
can see some of the differences between them using "fsutil reparsepoint
query <path>", where "<path>" is a junction or symlink.

In Vista and later, symlinks and junctions can be created with the
mklink command. (I've seen some comments about symlinks being available
in earlier versions of NTFS, via Services for Unix; but at least in SFU
2.0, symlinks were just files with a special format, not reparse
points.)

The Windows SMB server apparently won't cross reparse points, though, so
there's no equivalent vulnerability.

--
Michael Wojcik
Principal Software Systems Developer, Micro Focus

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: [Full-disclosure] Samba Remote Zero-Day Exploit
    ... Since Windows 2000 NTFS supports "junctions", ... And at least since Vista, it also supports symlinks, which are ... Windows SMB server crosses reparse points! ... the "unix extensions" need to be ...
    (Full-Disclosure)
  • Re: ?le"
    ... Hard- und Soft-Links. ... SymLinks erst mit NTFS 6.0, vorher Junctions), ... Da war noch nix mit echten Symlinks. ...
    (de.sci.electronics)
  • RE: Samba Remote Zero-Day Exploit
    ... Since Windows 2000 NTFS supports "junctions", ... And at least since Vista, it also supports symlinks, which are ... Windows SMB server crosses reparse points! ... someone shares a branch of the directory tree in the ...
    (Bugtraq)
  • Re: [Full-disclosure] Samba Remote Zero-Day Exploit
    ... Since Windows 2000 NTFS supports "junctions", ... And at least since Vista, it also supports symlinks, which are ... Windows SMB server crosses reparse points! ... someone shares a branch of the directory tree in the ...
    (Full-Disclosure)
  • RE: Samba Remote Zero-Day Exploit
    ... Traversing symlinks on the server/share, ... Since Windows 2000 NTFS supports "junctions", ... symlinks are implemented with NTFS reparse points, ...
    (Bugtraq)