Samba vulnerability discovered. Actually not WD's fault

[Myron]

Just received an update for DL series NASs to address Samba vulnerabilities. Took a long time from the time of public disclosure.

[Bennor]

The latest single bay My Cloud 2.x firmware released a day or two ago also got the fix for CVE-2017-7494.

[cpt_paranoia]

Let’s hope they finally get around to the v4 firmware…

[d_fens]

FYI: StorageCrypter / SambaCry Ransomware Support (.locked, _READ_ME_FOR_DECRYPT.txt) - Ransomware Help & Tech Support

Update if you haven‘t done yet

[Bennor]

@d_fens

Update if you haven‘t done yet

And if you don’t want to update then disable remote access at the very least.

[d_fens]

some of the victims had no chance to avoid infection because WD relase the fix so late, in mid to late november. It was made available by samba in may, and almost every other NAS vendor patched it in time.
even seagate updated their firmware in july!

now WD should fix this one: Samba - Security Announcement Archive

[Myron]

Not too much of an issue, at least for me. SMB server’s ports are not exposed to the Internet. If I need SMB access from the Internet then I’ll be setting-up a Rasberry Pi as a VPN server.

… but it’ll now be interesting to see how long it takes for WD up apply an update to this one.

[Fox_exe]

Im using latest Samba on Debian Stretch and dont have any problems