14 DAY TRIAL // While most OS X security vulnerabilities that make the headlines pose little if any real threat, the latest exploit that has been identified is a serious matter. OS X users in mixed networks that include Windows PCs should be weary of a potential vulnerability that leverages the protocol Macs use to communicate with PCs. The unpatched vulnerability in Samba and print sharing software can be used by attackers to compromise the security of the computer.
Samba was plagued by multiple heap-based buffer overflow bugs earlier this month, and exploits have been released that target the vulnerabilities on several Linux distributions. Although the protocol is turned off by default in OS X, users on mixed networks most likely have it turned on in order to share files with Windows PCs. Apple last updated Samba in 2005, so no matter how up-to-date you are with security updates from Apple, your machine is still vulnerable. Users are urged to download and install the latest version of Samba 3.0.25 from the official website. Also, turning off Windows Sharing from the Sharing preference pane will disable the protocol and thus make exploitation of the vulnerability impossible.
So far, The DeepSight Threat Analyst Team successfully exploited the heap corruption vulnerability on a fully patched Mac OS X 10.4.9 system running the default Samba 3.0.10 application. While exploitation seems to be slightly different from what has been demonstrated in public exploits, other exploits could be under development. Unlike other previous security threats that have made splashy headlines, but posed no major threat, this is the real deal. Hopefully Apple will issue a security update in the near future, upgrading Samba to the latest version. In the mean time, users should either upgrade to the latest version of Samba themselves, or turn off the Windows file sharing protocol.