critique
CVE-2017-7494
samba: Loading shared modules from any path in the system leading to RCE (SambaCry)
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (élevée), Amazon (élevée), Oracle (élevée), Ubuntu (élevée).
Description
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb, ctdb-tests, libsmbclient et 21 autres | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x, samba3x-client, samba3x-common et 5 autres | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient, libsmbclient-devel, samba et 23 autres | 3.6.23-43.0.1.el6_9 et 1 autres |
Afficher les 100 entrées de 20 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb | 4.4.4-13.35.amzn1 |
| amazon linux 1 | ctdb-tests | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-tools | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-debuginfo | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-krb5-printing | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-pidl | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-python | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-clients | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-krb5-locator | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-modules | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-client | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-common | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-doc | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-domainjoin-gui | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-swat | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind-devel | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | libsmbclient-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-client | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-common | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-doc | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-domainjoin-gui | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-glusterfs | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-swat | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-clients | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-krb5-locator | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba4 | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-client | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-common | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-devel | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-pidl | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-python | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-test | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-clients | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-krb5-locator | 4.2.10-10.el6_9 |
| Oracle Linux 7 | ctdb | 4.4.4-14.el7_3 |
| Oracle Linux 7 | ctdb-tests | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-tools | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-krb5-printing | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-pidl | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-python | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-vfs-glusterfs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-clients | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-krb5-locator | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-modules | 4.4.4-14.el7_3 |
| root.io debian 12 | rootio-samba | 2:4.5.8+dfsg-2 |
| ubuntu 14.04 | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 14.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 16.04 | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.10 | samba | 2:4.4.5+dfsg-2ubuntu5.6 |
| ubuntu 17.04 | samba | 2:4.5.8+dfsg-0ubuntu0.17.04.2 |
Références
- http://www.debian.org/security/2017/dsa-3860
- http://www.securityfocus.com/bid/98636
- http://www.securitytracker.com/id/1038552
- https://access.redhat.com/errata/RHSA-2017:1270
- https://access.redhat.com/errata/RHSA-2017:1271
- https://access.redhat.com/errata/RHSA-2017:1272
- https://access.redhat.com/errata/RHSA-2017:1273
- https://access.redhat.com/errata/RHSA-2017:1390
Les 25 références
- https://access.redhat.com/security/cve/CVE-2017-7494
- https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us
- https://linux.oracle.com/cve/CVE-2017-7494.html
- https://linux.oracle.com/errata/ELSA-2017-1272.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-7494
- https://security.gentoo.org/glsa/201805-07
- https://security.netapp.com/advisory/ntap-20170524-0001/
- https://ubuntu.com/security/notices/USN-3296-1
- https://ubuntu.com/security/notices/USN-3296-2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494
- https://www.cve.org/CVERecord?id=CVE-2017-7494
- https://www.exploit-db.com/exploits/42060/
- https://www.exploit-db.com/exploits/42084/
- https://www.samba.org/samba/security/CVE-2017-7494.html