critical
CVE-2017-7494
samba: Loading shared modules from any path in the system leading to RCE (SambaCry)
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Amazon (high), Oracle (high), Ubuntu (high).
Description
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb, ctdb-tests, libsmbclient and 21 more | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x, samba3x-client, samba3x-common and 5 more | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient, libsmbclient-devel, samba and 23 more | 3.6.23-43.0.1.el6_9 and 1 more |
Show all 100 entries from 20 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.3 | samba | 4.2.14-r3 |
| alpine 3.4 | samba | 4.4.14-r0 |
| amazon linux 1 | ctdb | 4.4.4-13.35.amzn1 |
| amazon linux 1 | ctdb-tests | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libsmbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient | 4.4.4-13.35.amzn1 |
| amazon linux 1 | libwbclient-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-client-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-common-tools | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-debuginfo | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-devel | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-krb5-printing | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-pidl | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-python | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-test-libs | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-clients | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-krb5-locator | 4.4.4-13.35.amzn1 |
| amazon linux 1 | samba-winbind-modules | 4.4.4-13.35.amzn1 |
| debian 11 | samba | 2:4.5.8+dfsg-2 |
| debian 12 | samba | 2:4.5.8+dfsg-2 |
| debian 13 | samba | 2:4.5.8+dfsg-2 |
| debian 14 | samba | 2:4.5.8+dfsg-2 |
| debian 7 | samba | 2:3.6.6-6+deb7u13 |
| debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 |
| echo | samba | 2:4.5.8+dfsg-2 |
| Oracle Linux 5 | samba3x | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-client | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-common | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-doc | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-domainjoin-gui | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-swat | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 5 | samba3x-winbind-devel | 3.6.23-13.0.2.el5_11 |
| Oracle Linux 6 | libsmbclient | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | libsmbclient-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-client | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-common | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-doc | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-domainjoin-gui | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-glusterfs | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-swat | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-clients | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-devel | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba-winbind-krb5-locator | 3.6.23-43.0.1.el6_9 |
| Oracle Linux 6 | samba4 | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-client | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-common | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-dc-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-devel | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-libs | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-pidl | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-python | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-test | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-clients | 4.2.10-10.el6_9 |
| Oracle Linux 6 | samba4-winbind-krb5-locator | 4.2.10-10.el6_9 |
| Oracle Linux 7 | ctdb | 4.4.4-14.el7_3 |
| Oracle Linux 7 | ctdb-tests | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libsmbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient | 4.4.4-14.el7_3 |
| Oracle Linux 7 | libwbclient-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-client-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-common-tools | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-dc-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-devel | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-krb5-printing | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-pidl | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-python | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-test-libs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-vfs-glusterfs | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-clients | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-krb5-locator | 4.4.4-14.el7_3 |
| Oracle Linux 7 | samba-winbind-modules | 4.4.4-14.el7_3 |
| root.io debian 12 | rootio-samba | 2:4.5.8+dfsg-2 |
| ubuntu 14.04 | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 14.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 |
| ubuntu 16.04 | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.04-ESM | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 |
| ubuntu 16.10 | samba | 2:4.4.5+dfsg-2ubuntu5.6 |
| ubuntu 17.04 | samba | 2:4.5.8+dfsg-0ubuntu0.17.04.2 |
References
- http://www.debian.org/security/2017/dsa-3860
- http://www.securityfocus.com/bid/98636
- http://www.securitytracker.com/id/1038552
- https://access.redhat.com/errata/RHSA-2017:1270
- https://access.redhat.com/errata/RHSA-2017:1271
- https://access.redhat.com/errata/RHSA-2017:1272
- https://access.redhat.com/errata/RHSA-2017:1273
- https://access.redhat.com/errata/RHSA-2017:1390
All 25 references
- https://access.redhat.com/security/cve/CVE-2017-7494
- https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us
- https://linux.oracle.com/cve/CVE-2017-7494.html
- https://linux.oracle.com/errata/ELSA-2017-1272.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-7494
- https://security.gentoo.org/glsa/201805-07
- https://security.netapp.com/advisory/ntap-20170524-0001/
- https://ubuntu.com/security/notices/USN-3296-1
- https://ubuntu.com/security/notices/USN-3296-2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494
- https://www.cve.org/CVERecord?id=CVE-2017-7494
- https://www.exploit-db.com/exploits/42060/
- https://www.exploit-db.com/exploits/42084/
- https://www.samba.org/samba/security/CVE-2017-7494.html