Critical severity · published May 30, 2017
CVE-2017-7494
Samba Remote Code Execution Vulnerability
RansomwareIn wildKEV
9.8
CVSS
99.4%
EPSS
Yes
On KEV
Description
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.4% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 30, 2023
Federal remediation dueApr 20, 2023
Ransomware campaign useKnown
Affected products
Which versions
SA
samba · Samba
since 3.5.0 · source: vendor, NVD, KEV
DL
Debian Linux · Debian
8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7494
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7494
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vdb-entry
http://www.securityfocus.com/bid/98636
vendor-advisory
http://www.debian.org/security/2017/dsa-3860
exploit
https://www.exploit-db.com/exploits/42084/
vendor-advisory
https://access.redhat.com/errata/RHSA-2017:1270
x_refsource_CONFIRM
https://www.samba.org/samba/security/CVE-2017-7494.html
x_refsource_MISC
https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01
More from samba
5.5
CVE-2020-1472
Netlogon Elevation of Privilege Vulnerability
9.8
CVE-2026-4408
Samba: remote code execution in samr
9.8
CVE-2023-3961
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory
9.8
CVE-2022-45141
Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assumed that rc4-hmac is weak, Vulnerable…
9.8
CVE-2022-44640
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC)