Samba Remote Code Execution Vulnerability – CVE-2015-0240

The Samba team reported CVE-2015-0240 last February 23, 2015. This vulnerability is very difficult to exploit and we are not aware of successful exploitation. However, it is quite interesting from the point for view of detection. There are two important facts:

The vulnerability resides in the Netlogon Remote Protocol implementation of Samba which is a very high-level application protocol that can be used over different transports configurations.
To execute the vulnerable code the attacker doesn’t need be authenticated and can use many ways to launch the attacks because of the previous point. This is very motivating for attackers as they can find ways to bypass Intrusion Prevention System (IPS).

There is a very good public description about the vulnerability, which can be found at this link. In this post, we will discuss it from the point of view of involved protocols and possible attack surfaces.

Vulnerability description

The vulnerability resides in the Netlogon Remote Protocol implementation of Samba, specifically in the method NetrServerPasswordSet. The Netlogon Remote Protocol was implemented for interoperability with Microsoft Windows environments and for simulating Primary Domain Controllers. Using the Netlogon Remote Protocol Windows and Linux machines can be part of the Samba PDC domain even without the use of Active Directory. The method NetrServerPasswordSet is used to change the machine account password in a Samba domain.

The method NetrServerPasswordSet is implemented in _netr_ServerPasswordSet() in the source file samba\source3\rpc_server\netlogon\srv_netlog_nt.c. The “creds” pointer is passed into netr_creds_server_step_check() without initialization. The following figure shows the vulnerable code section:

Figure 1. Vulnerable code section

The triggering conditions can be different for Samba v3 and Samba v4 as pointed in this analysis. The attacker can control “computer_name” and “credentials” to reach the vulnerable code section making this vulnerability as possibly exploitable.

There is a public POC triggering the vulnerable code. Running this POC and doing dynamic analysis shows that effectively the method _netr_ServerPasswordSet is called. The following figure shows the resumed call graph of Samba.

Figure 2. Call graph of Samba

Running Samba with high level debugging can allow us to get more runtime information. Example of a command:

smbd –D –S /etc/samba/smb.conf -d 10

The following figure shows a section of the resulting log after running the POC.

Figure 3. Section of resulting log after running the POC

After some more lines we got:

This error message is logged by the function schannel_fetch_session_key_tdb and returns the error with NT_STATUS_OBJECT_NAME_NOT_FOUND. This function is called by shannel_check_creds_state.

Figure 4. The error NT_STATUS_OBJECT_NAME_NOT_FOUND

The error NT_STATUS_OBJECT_NAME_NOT_FOUND will force _netr_ServerPasswordSet to free the “creds” pointer. Looking at the network packets in the following figure we can see the Netlogon Protocol using the transport RPC over SMB.

Figure 5. Netlogon Protocol using the transport RPC over SMB

And this is one important point regarding to the attack detection. The Netlogon protocol is a high-level application protocol and can use two transport types: RPC over SMB and RPC over TCP/IP. The next section discusses more about this topic.

Attack Delivery Mechanisms

The Netlogon Remote Protocol is a very high level application protocol that can run on different protocol stack configurations. The following figure shows it.

Figure 6. Netlogon Protocol runs on different protocol stack configurations

Figure 6 shows that theoretically, an attacker can use two stack configurations to reach the vulnerable code. They are: RPC over TCP/IP and RPC over SMB. These two configurations will use different network ports and communication mechanisms. This is a panacea for implementing attacks bypassing IPS. But even more interesting is the case over SMB where the NetrServerPasswordSet can be called using several SMB commands and at the same time the parameters to the method can be encrypted and unencrypted. The following figure shows other ways to call NetrServerPasswordSet.

Figure 7. Other ways to call NetrServerPasswordSet

Conclusion
The vulnerability it is not easy to exploit and we are not aware of public exploits until now. However, the attack can be implemented in many different ways and the fact that it is not required to be authenticated makes it easy for the attackers.

Implementing the protection requires coverage of multiple protocol stack configurations and multi commands over SMB.

To protect our costumers Deep Security Vulnerability Research Labs released the filter with id: 1006555. Customers are required to apply this Deep Security Rules immediately.

Post from: Trendlabs Security Intelligence Blog – by Trend Micro

Samba Remote Code Execution Vulnerability – CVE-2015-0240