Re: Samba Remote Zero-Day Exploit

Michael Wojcik wrote:

From: Stefan Kanthak [mailto:stefan.kanthak@xxxxxxxx]
Sent: Saturday, 06 February, 2010 08:21

Dan Kaminsky wrote:

[...]

(On a side note, you're not going to see this sort of symlink stuff
on Windows,

What exactly do you mean?
Traversing symlinks on the server/share, or creation of "wide"
symlinks
by the client on the server/share?

Since Windows 2000 NTFS supports "junctions", which pretty much
resemble Unix symlinks, but only for directories.
See <http://support.microsoft.com/kb/205524/en-us>

And at least since Vista, it also supports symlinks, which are designed

s/at least//

[ well-known facts snipped ]

The Windows SMB server apparently won't cross reparse points, though, so
there's no equivalent vulnerability.

NO, Windows SMB server crosses reparse points!

But as Dan Kaminsky pointed out, you need to have administrative rights
to remotely create a junction on an SMB share, so the non-admin user
cant get himself access to files outside a share he's allowed to access.

Stefan

Relevant Pages

  • Re: [Full-disclosure] Samba Remote Zero-Day Exploit
    ... Traversing symlinks on the server/share, ... Since Windows 2000 NTFS supports "junctions", ... But as Dan Kaminsky pointed out, you need to have administrative rights ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Samba Remote Zero-Day Exploit
    ... Since Windows 2000 NTFS supports "junctions", ... And at least since Vista, it also supports symlinks, which are ... Windows SMB server crosses reparse points! ... the "unix extensions" need to be ...
    (Full-Disclosure)
  • Re: Linking with samba
    ... > Does anyone have any information on the state of links (hard links or ... > symlinks, or even silly Windows shortcuts) in Samba? ... > More specifically I have a Windows 2003 share mounted on RHEL 3 and I'm ...
    (comp.protocols.smb)
  • Re: using sys/fusefs-ntfs as the home dir
    ... As far as I know, FreeBSD's NTFS support is okay for reading, but ... "Windows" stuff around to check.) ... OS's and besides many symlinks are ... You can't just use the same home directory. ...
    (freebsd-questions)
  • Re: Amazon used lisp & C exclusively?
    ... So the package seems to check for the existance of a symlink. ... Note that this technique would work equally well under Windows, since Windows has symlinks to directories. ... reuired because of broken unix programs. ... And if Windows does such things a different way, that doesn't mean Windows is broken because it's missing symlinks. ...
    (comp.lang.lisp)