Security News > 2022 > January > Samba bug can let remote attackers execute code as root
Samba has addressed a critical severity vulnerability that can let attackers gain remote code execution with root privileges on servers running vulnerable software.
Samba is an SMB networking protocol re-implementation that provides file sharing and printing services across many platforms, allowing Linux, Windows, and macOS users to share files over a network.
"The problem in vfs fruit exists in the default configuration of the fruit VFS module using fruit:metadata=netatalk or fruit:resource=file," Samba explained in a security advisory published today.
Attackers can exploit the flaw in low complexity attacks without requiring user interaction if the targeted servers run any Samba installations before version 4.13.17, the release that addresses this bug.
Samba also provides a workaround for admins who cannot immediately install the latest releases, which requires them to remove 'fruit' from 'vfs objects' lines in their Samba configuration files.
As the Samba Team notes, "Changing the VFS module settings fruit:metadata or fruit:resource to use the unaffected setting causes all stored information to be inaccessible and will make it appear to macOS clients as if the information is lost."