CVE-2021-44142: Versions of Samba prior to 4.13.17 Vuln

[Scoot_Mulner]

Hello,

I just noticed CVE-2021-44142 and wanted to check the correct steps to mitigate. I am running TrueNAS-12.0-U7 with a couple Apple computers on the network and I have Samba 4.13.14 which is vulnerable.

Code:

# smbd -V
Version 4.13.14

I do have an AFP share that I use to share a single HDD for Time Machine backups. I think that part is fine because, it isn't using Samba.

Under the "Advanced Options" for my Samba share configurations, I do have "Use Apple-style Character Encoding" checked off and I see a "Time Machine" checkbox but I'm not using that so it is unchecked. I don't have anything with the word "fruit" in my "Auxiliary Parameters" section for any of the shares either.

Also, under the Samba service configuration, I see a checkbox for "Enable Apple SMB2/3 Protocol Extensions".

So my question is, if all three of those items are unchecked and I don't have any fruity things in my auxiliary parameters, is TrueNAS safe?
1) Use Apple-style Character Encoding
2) Time Machine
3) Enable Apple SMB2/3 Protocol Extensions

Thanks.

 

[Patrick M. Hausen]

Going to be fixed in 12.0-U8:

https://jira.ixsystems.com/browse/NAS-114468

 

[Scoot_Mulner]

Thanks for the link Patrick, lots of useful stuff in there.

From the link:
"testparm -s" will list all the Samba parameters. Then look for "fruit:metadata=netatalk" or "fruit:resource=file" for each share.

 

[anodos]

Right. I have also provided a basic overview at the end of this thread: https://www.truenas.com/community/threads/truenas-12-0-u7-released.97293/page-3#post-680119

 

[Borja Marcos]

As a suggestion:

Given that it's an extremely serious vulnerability (Truenas becomes vulnerable against a compromised client machine) it would be extremely helpful if unambiguous instructions to remove those options were posted quickly.

If possible, so that it can be done from the GUI.

 

[anodos]

As a suggestion:

Given that it's an extremely serious vulnerability (Truenas becomes vulnerable against a compromised client machine) it would be extremely helpful if unambiguous instructions to remove those options were posted quickly.

If possible, so that it can be done from the GUI.

This will be covered in the release notes for U8 which is will be released tomorrow. The overview in the Jira ticket is for informational / historical purposes. It is generally not a good idea to change how apple metadata is stored if it can be avoided (your users will lose things like finder color tags).

 

[anodos]

U8 has been released: https://download.freenas.org/12.0/STABLE/U8/ (and through normal update mechanisms)