samba - Apr 2014 - Samba 4.1.6 huge security flaw

Hi all,

I've been running Samba 4.1.6 in production for 2 weeks now and it's
been
great. However I noticed a huge security flaw today that I hit only once. I
access Samba4 shares over the VPN that is irrelevant since the security
access is user-based, not IP based. What happens right after the connection,
Windows tries to read the shares and some are empty, but they are not
supposed to be. Then, after about 3-5 minutes, the shares populate and I
would include this into normality.

However, I get to see the contents of shares that I SHOULD NOT have access
to. I tried to reproduce the same from the VPN of a Linux machine with the
same user and the access is denied as it should be. The same I tried from
another Windows machine over the VPN and access is denied. Same I tried to
reproduce from within the same LAN and access is denied.

So, for whatever reason, from one specific Windows machine, I am able to
browse content with a user that was not granted the access. I checked the
security tab for the folder and the access looks ok. Still, a huge security
flaw is there and I do not know how to give you more details, but it needs
to be looked at.

I noticed the 3-5 minutes wait time on 2 Samba 4.1.6 servers since I am
running a production testing environment at home. However at home we are 3
users, but the server I noticed the issue on is running for 30 users. I
suspect something probably happens in the 3-5 minutes with the Windows
browsing and today I got access. I cannot provide more info guys. The best I
can post logs if you tell me specifically what to look for. The bug was
noticed at around 2:50pm MST. Please tell me what you need, so I can assist.



--
View this message in context:
http://samba.2283325.n4.nabble.com/Samba-4-1-6-huge-security-flaw-tp4664312.html
Sent from the Samba - General mailing list archive at Nabble.com.

This is what I see in the log.samba:

  NTLMSSP NTLM2 packet check failed due to invalid signature!
[2014/04/11 14:33:55.270648,  0]
../auth/ntlmssp/ntlmssp_sign.c:236(ntlmssp_check_packet)
  NTLMSSP NTLM2 packet check failed due to invalid signature!
[2014/04/14 08:30:22.271964,  0]
../auth/ntlmssp/ntlmssp_sign.c:236(ntlmssp_check_packet)
  NTLMSSP NTLM2 packet check failed due to invalid signature!
[2014/04/14 14:52:24.799161,  0] ../source4/smbd/server.c:121(sig_term)
[2014/04/14 14:52:24.799128,  0] ../source4/smbd/server.c:116(sig_term)
[2014/04/14 14:52:24.799176,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1801 on SIGTERM
[2014/04/14 14:52:24.799270,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1802 on SIGTERM
  SIGTERM: killing children
[2014/04/14 14:52:24.799417,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1804 on SIGTERM
  Exiting pid 1808 on SIGTERM
[2014/04/14 14:52:24.799322,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1805 on SIGTERM
[2014/04/14 14:52:24.799426,  0] ../source4/smbd/server.c:121(sig_term)
[2014/04/14 14:52:24.799792,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1809 on SIGTERM
[2014/04/14 14:52:24.802495,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1814 on SIGTERM
[2014/04/14 14:52:24.799672,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1807 on SIGTERM
[2014/04/14 14:52:24.804586,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1813 on SIGTERM
  Exiting pid 1806 on SIGTERM
[2014/04/14 14:52:24.799545,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1800 on SIGTERM
[2014/04/14 14:52:24.809454,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1811 on SIGTERM
[2014/04/14 14:52:24.812416,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1812 on SIGTERM
[2014/04/14 14:52:24.855421,  0] ../source4/smbd/server.c:121(sig_term)
  Exiting pid 1810 on SIGTERM
[2014/04/14 14:52:32.976404,  0]
../source4/smbd/server.c:370(binary_smbd_main)
  samba version 4.1.6 started. -> this is where I restarted the server to
see if it still happens and it did after as well.

I do get these every once in a while in log.smbd:
[2014/04/11 07:57:47.860716,  0]
../source3/smbd/oplock.c:335(oplock_timeout_handler)
  Oplock break failed for file
fileserver.specified.ca/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI
-- replying anyway

The rest looks ok to me... I am not sure what else to provide. I am not sure
if I can replicate the same bug after the Windows machine restart, but I
will try and let you know.



--
View this message in context:
http://samba.2283325.n4.nabble.com/Samba-4-1-6-huge-security-flaw-tp4664312p4664313.html
Sent from the Samba - General mailing list archive at Nabble.com.