SAMBA SWAT Logfile Permissions Vulnerability
BID:1874
Info
SAMBA SWAT Logfile Permissions Vulnerability
| Bugtraq ID: | 1874 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 01 2000 12:00AM |
| Updated: | Nov 01 2000 12:00AM |
| Credit: | credit This vulnerability was dicovered by Miah <[email protected]>. |
| Vulnerable: |
Samba Samba 2.0.7 |
| Not Vulnerable: | |
Discussion
SAMBA SWAT Logfile Permissions Vulnerability
The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access.
This problem in particular is a permissions problem where users can take advantage of poor permission setting in SWAT's log files to read username and password data which SWAT records for all users which login to remotely administrate the server. If logging is turned on (it is not enabled by default) SWAT it logs by default to:
/tmp/cgi.log
This file is world readable and contains usernames and passwords which local users may pull from the file (base64 encoded).
The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access.
This problem in particular is a permissions problem where users can take advantage of poor permission setting in SWAT's log files to read username and password data which SWAT records for all users which login to remotely administrate the server. If logging is turned on (it is not enabled by default) SWAT it logs by default to:
/tmp/cgi.log
This file is world readable and contains usernames and passwords which local users may pull from the file (base64 encoded).
Exploit / POC
Solution / Fix
SAMBA SWAT Logfile Permissions Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
A non vendor supported solution is available at:
Samba Samba 2.0.7
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
A non vendor supported solution is available at:
Samba Samba 2.0.7
-
Miah Unoffical Patch
http://uberhax0r.net/~miah/swat/
References
SAMBA SWAT Logfile Permissions Vulnerability
References:
References:
- Samba Homepage (Samba)
- Writeup on the SWAT Vulnerability (Miah)