vulnwire
9.8crit

CVE-2017-7494KEV · ransomwarein critical feed2 exploits

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious cl…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2023-03-30
EPSS
99.4%
percentile 100%
Public exploits
2
Exploit-DB

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

Known exploited (CISA KEV)

Added
3 y ago
Due date
2023-04-20 (3 y ago)
Ransomware use
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor / product
Samba / Samba
CISA name
Samba Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

99.45% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-42084 Samba 3.5.0 < 4.4.14/4.5.10/4.6.4 - 'is_known_pipename()' Arbitrary Module Load (Metasploit) · remote · 2017-05-29
  • EDB-42060 Samba 3.5.0 - Remote Code Execution · remote · 2017-05-24

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Samba samba

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

  • securityfocus.com /bid/98636 · vdb-entry, x_refsource_BID, x_transferred
  • debian.org /security/2017/dsa-3860 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • exploit-db.com /exploits/42084/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • access.redhat.com /errata/RHSA-2017:1270 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • samba.org /samba/security/CVE-2017-7494.html · x_refsource_CONFIRM, x_transferred
  • download.schneider-electric.com /files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Um · x_refsource_MISC, x_transferred
  • access.redhat.com /errata/RHSA-2017:1390 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securitytracker.com /id/1038552 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • access.redhat.com /errata/RHSA-2017:1273 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2017:1271 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • security.gentoo.org /glsa/201805-07 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2017:1272 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • security.netapp.com /advisory/ntap-20170524-0001/ · x_refsource_CONFIRM, x_transferred
  • h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/42060/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.