crítica
CVE-2017-7494
samba: Loading shared modules from any path in the system leading to RCE (SambaCry)
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), Amazon (alta), Oracle (alta), Ubuntu (alta).
Descripción
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb, ctdb-tests, libsmbclient y 21 más | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x, samba3x-client, samba3x-common y 5 más | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient, libsmbclient-devel, samba y 23 más | 3.6.23-43.0.1.el6_9 y 1 más |
Mostrar las 100 entradas de 20 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb | 4.4.4-13.35.amzn1 |
| amazon linux 1 | ctdb-tests | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-tools | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-debuginfo | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-krb5-printing | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-pidl | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-python | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-clients | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-krb5-locator | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-modules | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-client | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-common | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-doc | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-domainjoin-gui | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-swat | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind-devel | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | libsmbclient-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-client | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-common | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-doc | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-domainjoin-gui | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-glusterfs | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-swat | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-clients | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-krb5-locator | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba4 | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-client | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-common | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-devel | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-pidl | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-python | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-test | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-clients | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-krb5-locator | 4.2.10-10.el6_9 |
| Oracle Linux 7 | ctdb | 4.4.4-14.el7_3 |
| Oracle Linux 7 | ctdb-tests | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-tools | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-krb5-printing | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-pidl | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-python | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-vfs-glusterfs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-clients | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-krb5-locator | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-modules | 4.4.4-14.el7_3 |
| root.io debian 12 | rootio-samba | 2:4.5.8+dfsg-2 |
| ubuntu 14.04 | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 14.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 16.04 | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.10 | samba | 2:4.4.5+dfsg-2ubuntu5.6 |
| ubuntu 17.04 | samba | 2:4.5.8+dfsg-0ubuntu0.17.04.2 |
Referencias
- http://www.debian.org/security/2017/dsa-3860
- http://www.securityfocus.com/bid/98636
- http://www.securitytracker.com/id/1038552
- https://access.redhat.com/errata/RHSA-2017:1270
- https://access.redhat.com/errata/RHSA-2017:1271
- https://access.redhat.com/errata/RHSA-2017:1272
- https://access.redhat.com/errata/RHSA-2017:1273
- https://access.redhat.com/errata/RHSA-2017:1390
Las 25 referencias
- https://access.redhat.com/security/cve/CVE-2017-7494
- https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us
- https://linux.oracle.com/cve/CVE-2017-7494.html
- https://linux.oracle.com/errata/ELSA-2017-1272.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-7494
- https://security.gentoo.org/glsa/201805-07
- https://security.netapp.com/advisory/ntap-20170524-0001/
- https://ubuntu.com/security/notices/USN-3296-1
- https://ubuntu.com/security/notices/USN-3296-2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494
- https://www.cve.org/CVERecord?id=CVE-2017-7494
- https://www.exploit-db.com/exploits/42060/
- https://www.exploit-db.com/exploits/42084/
- https://www.samba.org/samba/security/CVE-2017-7494.html