Open-source security shines in Samba case

Recently discovered security holes in Samba were serious threats to companies using the popular freeware, which enables end users to access and use files, printers and other commonly shared resources on a company’s network or via the Internet. But they also demonstrated how the code-review process among those in the open-source community can ferret out vulnerabilities and how developers have adopted a new mindset, one in which secure coding is often seen as paramount over features and functionality. Security holes in open-source applications and systems have been making news in the last 12 months, with highly publicized flubs in Sendmail, Snort, Apache and PHP grabbing headlines. Samba joined that group with separate security warnings on March 14 and April 7. The first warned of a flaw in Samba’s main SMBD code which could allow an external attacker to remotely and anonymously gain root privileges on a server running a Samba server. SMBD is the server daemon that provides file-sharing and printing services to Windows clients. The second was a buffer overflow flaw that could also enable an attacker to remotely hijack a Samba server. Both struck deeply at the heart of developer Jeremy Allison, who wrote the original code in both instances. “We try to meet the highest standards. This is the third or fourth remote hole, which is not great, but it’s not bad when you consider we’ve been going 11 years,” Allison said. “We were not as security conscious as we are now. Originally, interoperability was the main goal. I did a lot of soul-searching on this. How did this happen? This is a personal embarrassment. The only explanation is that when I was writing the code way back when, we were concerned about making it work with Microsoft clients. Full Story