kritisch
CVE-2017-7494
samba: Loading shared modules from any path in the system leading to RCE (SambaCry)
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), Amazon (hoch), Oracle (hoch), Ubuntu (hoch).
Beschreibung
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb, ctdb-tests, libsmbclient und 21 weitere | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x, samba3x-client, samba3x-common und 5 weitere | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient, libsmbclient-devel, samba und 23 weitere | 3.6.23-43.0.1.el6_9 und 1 weitere |
Alle 100 Einträge aus 20 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb | 4.4.4-13.35.amzn1 |
| amazon linux 1 | ctdb-tests | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-tools | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-debuginfo | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-krb5-printing | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-pidl | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-python | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-clients | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-krb5-locator | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-modules | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-client | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-common | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-doc | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-domainjoin-gui | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-swat | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind-devel | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | libsmbclient-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-client | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-common | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-doc | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-domainjoin-gui | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-glusterfs | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-swat | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-clients | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-krb5-locator | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba4 | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-client | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-common | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-devel | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-pidl | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-python | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-test | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-clients | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-krb5-locator | 4.2.10-10.el6_9 |
| Oracle Linux 7 | ctdb | 4.4.4-14.el7_3 |
| Oracle Linux 7 | ctdb-tests | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-tools | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-krb5-printing | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-pidl | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-python | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-vfs-glusterfs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-clients | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-krb5-locator | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-modules | 4.4.4-14.el7_3 |
| root.io debian 12 | rootio-samba | 2:4.5.8+dfsg-2 |
| ubuntu 14.04 | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 14.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 16.04 | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.10 | samba | 2:4.4.5+dfsg-2ubuntu5.6 |
| ubuntu 17.04 | samba | 2:4.5.8+dfsg-0ubuntu0.17.04.2 |
Referenzen
- http://www.debian.org/security/2017/dsa-3860
- http://www.securityfocus.com/bid/98636
- http://www.securitytracker.com/id/1038552
- https://access.redhat.com/errata/RHSA-2017:1270
- https://access.redhat.com/errata/RHSA-2017:1271
- https://access.redhat.com/errata/RHSA-2017:1272
- https://access.redhat.com/errata/RHSA-2017:1273
- https://access.redhat.com/errata/RHSA-2017:1390
Alle 25 Referenzen
- https://access.redhat.com/security/cve/CVE-2017-7494
- https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us
- https://linux.oracle.com/cve/CVE-2017-7494.html
- https://linux.oracle.com/errata/ELSA-2017-1272.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-7494
- https://security.gentoo.org/glsa/201805-07
- https://security.netapp.com/advisory/ntap-20170524-0001/
- https://ubuntu.com/security/notices/USN-3296-1
- https://ubuntu.com/security/notices/USN-3296-2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494
- https://www.cve.org/CVERecord?id=CVE-2017-7494
- https://www.exploit-db.com/exploits/42060/
- https://www.exploit-db.com/exploits/42084/
- https://www.samba.org/samba/security/CVE-2017-7494.html