kritik
CVE-2017-7494
samba: Loading shared modules from any path in the system leading to RCE (SambaCry)
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), Amazon (yüksek), Oracle (yüksek), Ubuntu (yüksek).
Açıklama
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb, ctdb-tests, libsmbclient ve 21 tane daha | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x, samba3x-client, samba3x-common ve 5 tane daha | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient, libsmbclient-devel, samba ve 23 tane daha | 3.6.23-43.0.1.el6_9 ve 1 tane daha |
20 kaynaktaki 100 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb | 4.4.4-13.35.amzn1 |
| amazon linux 1 | ctdb-tests | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-tools | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-debuginfo | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-krb5-printing | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-pidl | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-python | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-clients | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-krb5-locator | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-modules | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-client | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-common | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-doc | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-domainjoin-gui | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-swat | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind-devel | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | libsmbclient-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-client | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-common | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-doc | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-domainjoin-gui | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-glusterfs | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-swat | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-clients | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-krb5-locator | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba4 | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-client | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-common | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-devel | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-pidl | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-python | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-test | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-clients | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-krb5-locator | 4.2.10-10.el6_9 |
| Oracle Linux 7 | ctdb | 4.4.4-14.el7_3 |
| Oracle Linux 7 | ctdb-tests | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-tools | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-krb5-printing | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-pidl | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-python | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-vfs-glusterfs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-clients | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-krb5-locator | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-modules | 4.4.4-14.el7_3 |
| root.io debian 12 | rootio-samba | 2:4.5.8+dfsg-2 |
| ubuntu 14.04 | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 14.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 16.04 | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.10 | samba | 2:4.4.5+dfsg-2ubuntu5.6 |
| ubuntu 17.04 | samba | 2:4.5.8+dfsg-0ubuntu0.17.04.2 |
Referanslar
- http://www.debian.org/security/2017/dsa-3860
- http://www.securityfocus.com/bid/98636
- http://www.securitytracker.com/id/1038552
- https://access.redhat.com/errata/RHSA-2017:1270
- https://access.redhat.com/errata/RHSA-2017:1271
- https://access.redhat.com/errata/RHSA-2017:1272
- https://access.redhat.com/errata/RHSA-2017:1273
- https://access.redhat.com/errata/RHSA-2017:1390
25 referansın hepsi
- https://access.redhat.com/security/cve/CVE-2017-7494
- https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us
- https://linux.oracle.com/cve/CVE-2017-7494.html
- https://linux.oracle.com/errata/ELSA-2017-1272.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-7494
- https://security.gentoo.org/glsa/201805-07
- https://security.netapp.com/advisory/ntap-20170524-0001/
- https://ubuntu.com/security/notices/USN-3296-1
- https://ubuntu.com/security/notices/USN-3296-2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494
- https://www.cve.org/CVERecord?id=CVE-2017-7494
- https://www.exploit-db.com/exploits/42060/
- https://www.exploit-db.com/exploits/42084/
- https://www.samba.org/samba/security/CVE-2017-7494.html