A serious remote code execution vulnerability has been discovered in the Samba file sharing software.  This bug allows an unauthenticated attacker to execute arbitrary code as root on an affected server.  With a CVSS score of 9.9, this vulnerability affects Samba’s default configurations.

Samba is a popular freeware utility that supports the SMB (Server Message Block) protocol on Unix like systems allowing them to interoperate with Microsoft Windows based devices.

The bug, tracked as CVE-2021-44142, means an unauthenticated attacker could execute arbitrary code as root on the target server which effectively means they could own the server and from there launch an attack across your network.

According to the security advisory from Samba:

All versions of Samba prior to 4.13.17 are vulnerable to an out-of-bounds heap read write vulnerability that allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfs_fruit.  

Vfs_fruit is the module that supports interoperability with Apple devices, allowing MacOS computers to use SMB when accessing shared resources on the Unix server.  The software is vulnerable in its default configuration of the VFS fruit module.

Workaround and mitigations

Patches are now available from Samba to fix this issue.

If it is not possible to patch immediately, then as a workaround the ‘fruit’ VFS module can be removed from the Samba configuration, although doing so will prevent any MacOS clients from being able to access the shared resource on the server.