CVE-2017-7494: critical vulnerability in samba
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.8epss 99%
from disclosure to weaponsame day
Published on NVDMay 30
1st PoCMay 24
metasploitMar 24
CISA KEV+2130d
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Fixed
41 products (3,291 components)
Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux ComputeNode (v. 7) · Red Hat Enterprise Linux ComputeNode Optional (v. 7) · Red Hat Enterprise Linux Server (v. 7) · and others 36
Not affected
1 product — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2023-04-20
Apply updates per vendor instructions.
In short
Samba file servers before version 4.6.4 have a critical flaw that lets attackers upload malicious code to shared folders and force the server to run it, taking complete control of the system.
Technical detail
A pre-authentication remote code execution vulnerability exists in Samba versions 3.5.0 through 4.6.3 where an attacker can upload a malicious shared library to a writable SMB share and trigger its execution on the server via unsafe dynamic library loading, achieving arbitrary code execution with server privileges.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Samba · sambapublic PoCs found — 43✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/42060exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/42084githubgithub.com/opsxcq/exploit-CVE-2017-7494★ 380githubgithub.com/joxeankoret/CVE-2017-7494★ 259githubgithub.com/betab0t/cve-2017-7494★ 181githubgithub.com/Waffles-2/SambaCry★ 63githubgithub.com/brianwrf/SambaHunter★ 57githubgithub.com/d3fudd/CVE-2017-7494_SambaCry★ 7githubgithub.com/0xm4ud/noSAMBAnoCRY-CVE-2017-7494★ 5githubgithub.com/I-Rinka/BIT-EternalBlue-for-macOS_Linux★ 4githubgithub.com/YonLiud/CVE-2017-7494★ 2githubgithub.com/Zer0d0y/Samba-CVE-2017-7494★ 1githubgithub.com/00mjk/exploit-CVE-2017-7494★ 1githubgithub.com/CyberCTF/vulhub-samba-cve-2017-7494★ 0githubgithub.com/JA-Cyber365/home-network-security-assessment★ 0githubgithub.com/homjxi0e/CVE-2017-7494★ 0githubgithub.com/incredible1yu/CVE-2017-7494★ 0githubgithub.com/FelipeR-UFBA/cve-2017-7494-fixed★ 0githubgithub.com/Sadz1d/IS★ 0githubgithub.com/cved-sources/cve-2017-7494★ 0githubgithub.com/Hansindu-M/CVE-2017-7494_IT19115344★ 0githubgithub.com/sudlit/CVE-2017-7494★ 0githubgithub.com/Zanex360/cdt-samba-deploy★ 0githubgithub.com/Zanex360/cdt-vulnsamba-deploy★ 0githubgithub.com/adjaliya/-CVE-2017-7494-Samba-Exploit-POC★ 0githubgithub.com/john-80/cve-2017-7494★ 0vulncheckvulncheck.com/xdb/5febf3930e17unverifiedcve_referencewww.exploit-db.com/exploits/42060/unverifiedvulncheckvulncheck.com/xdb/57e3c5583e71unverifiedvulncheckvulncheck.com/xdb/e8c24424c9d0unverifiedvulncheckvulncheck.com/xdb/6b2fdeea9b0eunverifiedvulncheckvulncheck.com/xdb/b4a79e992993unverifiedcve_referencewww.exploit-db.com/exploits/42084/unverifiedvulncheckvulncheck.com/xdb/06e94895d530unverifiedvulncheckvulncheck.com/xdb/710d63d67bedunverifiedvulncheckvulncheck.com/xdb/5192c6b266c3unverifiedvulncheckvulncheck.com/xdb/d60f0bdd37caunverifiedvulncheckvulncheck.com/xdb/e6971e9715d0unverifiedvulncheckvulncheck.com/xdb/03f724914e5dunverifiedvulncheckvulncheck.com/xdb/0e1687dfba66unverifiedvulncheckvulncheck.com/xdb/874bfa3f41ccunverifiedvulncheckvulncheck.com/xdb/6095b3679d4funverifiedvulncheckvulncheck.com/xdb/dd7a3ba13630unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — samba
In the same product, most dangerous first.
References
https://access.redhat.com/errata/RHSA-2017:1270https://access.redhat.com/errata/RHSA-2017:1271https://access.redhat.com/errata/RHSA-2017:1272https://access.redhat.com/errata/RHSA-2017:1273https://access.redhat.com/errata/RHSA-2017:1390https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_ushttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_ushttps://security.gentoo.org/glsa/201805-07https://security.netapp.com/advisory/ntap-20170524-0001/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494https://www.exploit-db.com/exploits/42060/