[es] - Critical bug infests newer versions of Microsoft Windows

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.dip0.t-ipconnect.de.

+7177 Profil

Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{10.09.2009. u 09:12 - pre 178 meseci}

http://www.theregister.co.uk/2...icrosoft_windows_security_bug/

Citat:

Microsoft has promised to patch a serious flaw in newer versions of its Windows operating system after hackers released exploit code that allows them to take complete control of the underlying machines.

The flaw, which affects various versions of Windows Vista, 2008, and the release candidate version of Windows 7, resides in the implementation of a network file sharing technology known as SMB, or server message block. The bug, which fails to adequately parse network negotiation requests, was previously believed only to generate a debilitating blue screen of death, but on Tuesday, Microsoft confirmed in some cases it could also be used to remotely execute malicious code on vulnerable machines.

Ovo je tragicno - SMB (iliti MSFT-ova tehnologija za deljenje drajvova i printera) je toliko busan da je to najveci izvor kriticnih bagova u Windows-ima vec vise od deceniju. Setimo se Nimda crva kao i bezbroj kriticnih propusta koji su dolazili od cuvenog porta 135 (SMB)

Ocigledno je da SMB u Microsoftu niko ne odrzava osim kada neko drugi prijavi kriticni bag.

Ovu tehnologiju bi ili trebalo zabraniti (hvala bogu pa su zablokirali SMB port na firewall-u po defaultu na internet konekcijama) ili bi Microsoft trebalo prisiliti da ceo SMB makne lepo u user-space.

Drzati ovakvo minsko polje u kernelu moze samo da steti svima.

Mozda bi bilo najbolje da Microsoft lepo licencira Sambu i drzi je kao servis sa ogranicenim pravima u user-modu.

DigiCortex (ex. SpikeFun) - Cortical Neural Network Simulator:
http://www.digicortex.net/node/1 Videos: http://www.digicortex.net/node/17 Gallery: http://www.digicortex.net/node/25
PowerMonkey - Redyce CPU Power Waste and gain performance! - https://github.com/psyq321/PowerMonkey

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.dip0.t-ipconnect.de.

+7177 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{10.09.2009. u 09:17 - pre 178 meseci}

Pritom osecam da je taj SMB kod tesko djubre pisano 20 godina koje se pretvorilo u monstruma i da se rad na njemu dobija iskljucivo po kazni - ono ako si zasrao neki projekat, dobijas "prekomandu na SMB", kad sef treba da te uplasi samo ti kaze "vidjen si za SMB"

Odgovor na temu

combuster
Ivan Bulatovic
Kraljevo

Član broj: 151351
Poruke: 4563
93.86.111.*

Sajt: www.linuxsrbija.org

+104 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{10.09.2009. u 09:30 - pre 178 meseci}

Samba ume da bude busna takodje, u kernelu je i CIFS i SMB sa tim sto se smb malo redje patch-uje u zadnje vreme ali CIFS da...

Code:

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
      [CIFS] Update readme to reflect forceuid mount parms
      cifs: Read buffer overflow
      cifs: show noforceuid/noforcegid mount options (try #2)
      cifs: reinstate original behavior when uid=/gid= options are specified
      [CIFS] Updates fs/cifs/CHANGES
      cifs: fix error handling in mount-time DFS referral chasing code


Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
      [CIFS] fix sparse warning
      cifs: fix sb->s_maxbytes so that it casts properly to a signed value
      cifs: disable serverino if server doesn't support it

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
      cifs: free nativeFileSystem field before allocating a new one
      [CIFS] Distinguish posix opens and mkdirs from legacy mkdirs in stats

cifs: free nativeFileSystem field before allocating a new one

    ...otherwise, we'll leak this memory if we have to reconnect (e.g. after
    network failure).

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
      cifs: when ATTR_READONLY is set, only clear write bits on non-directories
      cifs: remove cifsInodeInfo->inUse counter
      cifs: convert cifs_get_inode_info and non-posix readdir to use cifs_iget
      [CIFS] update cifs version number
      cifs: add and use CIFSSMBUnixSetFileInfo for setattr calls
      cifs: make a separate function for filling out FILE_UNIX_BASIC_INFO
      cifs: rename CIFSSMBUnixSetInfo to CIFSSMBUnixSetPathInfo
      cifs: add pid of initiating process to spnego upcall info
      cifs: fix regression with O_EXCL creates and optimize away lookup
      cifs: add new cifs_iget function and convert unix codepath to use it

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
      cifs: fix fh_mutex locking in cifs_reopen_file

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
      [CIFS] remove unknown mount option warning message
      [CIFS] remove bkl usage from umount begin
      cifs: Fix incorrect return code being printed in cFYI messages
      [CIFS] cleanup asn handling for ntlmssp
      [CIFS] Copy struct *after* setting the port, instead of before.
      cifs: remove rw/ro options
      cifs: fix problems with earlier patches
      cifs: have cifs parse scope_id out of IPv6 addresses and use it
      [CIFS] Do not send tree disconnect if session is already disconnected
      [CIFS] Fix build break
      cifs: display scopeid in /proc/mounts
      cifs: add new routine for converting AF_INET and AF_INET6 addrs
      cifs: have cifs_show_options show forceuid/forcegid options
      cifs: remove unneeded NULL checks from cifs_show_options

Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6

    * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
      cifs: remove never-used in6_addr option
      cifs: add addr= mount option alias for ip=
      [CIFS] Add mention of new mount parm (forceuid) to cifs readme
      cifs: make overriding of ownership conditional on new mount options
      cifs: fix IPv6 address length check
      cifs: clean up set_cifs_acl interfaces
      cifs: reorganize get_cifs_acl
      [CIFS] Update readme to indicate change to default mount (serverino)
      cifs: make serverino the default when mounting
      cifs: rename cifs_iget to cifs_root_iget
      cifs: make cnvrtDosUnixTm take a little-endian args and an offset
      cifs: have cifs_NTtimeToUnix take a little-endian arg
      cifs: tighten up default file_mode/dir_mode
      cifs: fix artificial limit on reading symlinks

Ovo je samo diff izmedju 2.6.30 i 2.6.31 verzija kernela... :)

make love - !war

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.dip0.t-ipconnect.de.

+7177 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{10.09.2009. u 09:37 - pre 178 meseci}

Onda takva komponenta mora biti u user-spaceu.

Danas to vise uopste nije preveliki problem jer je context-switch postao "jeftin" u novijim Intel procesorima (od druge generacije C2D masina)

Microsoft bi zaista trebao dobro da razmisli o tome - SMB im je izvor najgorih i najkriticnijih bagova do sada. Nekada je to bio ntdll.dll (cuveno "gadjanje" busnih funkcija fuzzing-om i instalacija novih sistemskih poziva) dok nisu raspisali kernel ponovo, sada je to SMB.

Odgovor na temu

combuster
Ivan Bulatovic
Kraljevo

Član broj: 151351
Poruke: 4563
93.86.111.*

Sajt: www.linuxsrbija.org

+104 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{10.09.2009. u 09:46 - pre 178 meseci}

E ali najjace mi je ovo:

cifs: free nativeFileSystem field before allocating a new one

...otherwise, we'll leak this memory if we have to reconnect (e.g. after
network failure).

Lol, pa nije cifs od juce da ima ovakve bug-ove :)

A pazi ovo:

Citat:

SMB2 reduces the 'chattiness' of the protocol by reducing the number of commands and subcommands from over a hundred to just nineteen.
SMB2 code has considerably less complexity since far less variability exists (for example, non-Unicode code paths become redundant as SMB2 requires Unicode support).

Oni jadni odradili cleanup totalni misleci da su time zavrsili posao :D E moji vi, back to the old drawing board...

make love - !war

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.dip0.t-ipconnect.de.

+7177 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{10.09.2009. u 09:51 - pre 178 meseci}

Klasican over-engineered monstrum. Ne cudi me to za Sambu, posto je osnovna stvar kompleksna - i njen klon je isto tako kompleksan i tezak za odrzavanje.

Najbolje resenje bi bilo razviti novi protokol za sharing sa osnovnim stvarima, koji bi bio fondacija za kompleksnije stvari (tipa DFS) i gde bi sve trcalo u user-modu, a onda ponuditi isti kroz update za Win XP / Server 2003 / Vistu / Server 2008 / Win 7 / Server 2008 R2

Naravno, Microsoft to nece uraditi - i odrzavace SMB skrndelj jos ko zna koliko godina. Njegova kompleksnost je zapravo i adut za prodaju Windows OS-eva, jer samo tada mozete imati 100% garanciju da sve radi :(

Na svu srecu, daleko oprezniji odnos prema sigurnosti gde je Windows Firewall podesen po defaultu da ne otvara SMB portove prema javnim mrezama umanjuje rizike - inace bi imali novi Nimda haos.

Odgovor na temu

z@re
Zarko Bulatovic
Split

Član broj: 29849
Poruke: 443
*.lama.hr.

+25 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{15.09.2009. u 14:05 - pre 178 meseci}

Moram priznat da integrirani firewall / security centar u Windowsima 7 ne izgleda nimalo lose.

_{Q: HSP56 Micromodem nece da radi kompjuter ga prepozna a kad treba da se konektujem nece ne daje ni znaka zivota. u cemu je problem.

A: Crko mozda od grmljavine mozda od spanaca. Uglavnom baci ga u WC solju jako povuci vodu. Skupi 5e i uzmi drugi i ne postuj temu na pogresno mesto.}

Odgovor na temu

Danijel Krmar
Novi Sad

Član broj: 158660
Poruke: 325
*.adsl.eunet.rs.

+9 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{15.09.2009. u 14:19 - pre 178 meseci}

Ako misliš na Windows Firewall with Advanced Security, to je uvedeno već i na Visti i Server-u 2008. Od kako to postoji, više ne koristim neki drugi third-party firewall.

www.printeks.rs

Odgovor na temu

z@re
Zarko Bulatovic
Split

Član broj: 29849
Poruke: 443
*.lama.hr.

+25 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{16.09.2009. u 09:30 - pre 177 meseci}

Da, mislim na taj.

Ugl, jel ko probao ovaj exploit? Meni izlega ne radi, u LANu, SMB port otvoren.

Odgovor na temu

EArthquake

Član broj: 20684
Poruke: 884
*.adsl.eunet.rs.

+67 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{19.09.2009. u 23:08 - pre 177 meseci}

hahaha , smb se definitivno kotira jako visoko na listi najgore dizajniranih protokola ikad

sto kaze dimkovic verovatno u MSu dobjas da radis na SMBu po kazni :)

zasto ga uopste cuvaju ? (prokleti backward compatibility , problem svih windowsa :) )

Odgovor na temu

CONFIQ
♫♪♥♪♫

Član broj: 4218
Poruke: 1994
*.red.bezeqint.net.

ICQ: 82327428

+10 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{20.09.2009. u 13:46 - pre 177 meseci}

Je li vi pricate o ovom bug-u?
http://seclists.org/fulldisclosure/2009/Sep/0039.html
Mada je ovo vise B.S.O.D....
Napisali exploid u pythonu od 5 linija... Pametno ;)

Ali poenta je da ovo nije stari SMB kao sto Ivan tvrdi. Ipak je ovo novi SMB ! SMB2? Tako da ovo nema nikakve veze sa istorijom SMB-a posto XP/win2k/me nemaju ovaj feature...

Odgovor na temu

Ivan Dimkovic

Administrator
Član broj: 13
Poruke: 16687
*.dip.t-dialin.net.

+7177 Profil

Re: Critical bug infests newer versions of Microsoft Windows - iliti SMB >OPET<

^{20.09.2009. u 15:40 - pre 177 meseci}

Pa i taj SMB2 je sigurno pisao isti tim invalida po kazni... fakat da su stavili protokol u kernel-mode driver (SRV2.SYS) je vec dovoljan indikator kretenizma - high-level protokolima kao sto je SMB nije mesto u kernel modu.

Ako su vec zbog performansi odlucili da drze HTTP i SMB u kernel modu (a za to je kriva besomucna trka izmedju Windows i Linux server vendora za performansama), mogli su bar da urade vrlo strog audit koda kako bi se sprecila situacija da dodje do krahiranja unutar koda koji se izvrsava u ring0 modu.

Microsoft stvarno sebi nekad puca u nogu - sa jedne strane, izmislili su sjaset novih tehnologija koje motivisu prelazak drajvera u user-mode - recimo za zvuk, printere, itd... a sa druge strane u ring0 zakopavaju potencijalna minska polja kao sto je SMB.

Odgovor na temu