Samba vulnerability calls to mind WannaCry fears to Linux/ UNIX

Researchers has released a warning that many Linux and UNIX systems contain a Samba vulnerability that could eventually lead to attacks similar to WannaCry or worse.

According to Samba security advisory, the vulnerability (CVE-2017-7494) affects version 3.5 and newer versions. The vulnerability is remotely exploitable and could allow a malicious client to upload a shared library to share and cause the server to load and execute it.Nick Bilogorskiy, senior director of threat operations at Cyphort said although there were no active exploits in Samba, the damage could be sheer consequences. " Because this vulnerability allows remote code execution, attackers will have full control over a compromised machine, and any payload is possible," Bilogorskiy told SearchSecurity. " For example, [an attacker could] drop a backdoor, steal data from the system, spy on the user, attack other systems or try to encrypt all data for a ransom."

Lane Thames, senior security researcher at Tripwire said the enterprises should act fast to patch this vulnerability and ensure that no unnecessary samba services are exposed to the internet.

The remediation for the vulnerability has been informed among the users. Rapid7 labs suggested that the organizations should review their firewalls rules to ensure that Samba network traffic is not allowed directly from the internet to their assets. Samba has also released a patch to remedy for the vulnerability. Samba also informed that adding an argument “ nt pipe support = no” to the global section of the Samba configuration file may mitigate the threat.

Thames further added " Enterprise server vendors are moving fast to push out patches to enterprise customers for this Samba vulnerability. However, [network-attached storage] vendors might not move so quickly on this and in some cases they might not even issue patches for this."

So what is the difference between WannaCry and Samba vulnerability is that both the issues affected the same protocol. Bilogorskiy has warned the Linux users that any Samba worm may hit Linux and UNIX servers, where most do not have auto-update enabled. In fact some of these UNIX systems work for years without any maintenance. Also, unlike workstations, most of them are always on, users never power them off. If the Samba vulnerability is directly connected to the internet the more the chances of online unpatched targets for a worm to infect.