PT-2017-2095 · Samba+5 · Samba+5
Publicado
2017-05-24
·
Atualizado
2026-03-10
·
CVE-2017-7494
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Samba versions 3.5.0 through 4.6.4
Samba versions 4.5.0 through 4.5.10
Samba versions 4.4.0 through 4.4.14
Description
The issue exists due to insufficient input validation in the Samba network file system. Exploitation of this issue may allow a remote attacker to execute arbitrary code, located in a library placed on a shared network resource, by sending a specially crafted network request to the Samba server. This can be achieved by a malicious client uploading a shared library to a writable share, and then causing the server to load and execute it.
Recommendations
For Samba versions 3.5.0 through 4.6.4, update to version 4.6.4 or later.
For Samba versions 4.5.0 through 4.5.10, update to version 4.5.10 or later.
For Samba versions 4.4.0 through 4.4.14, update to version 4.4.14 or later.
As a temporary workaround, consider restricting access to writable shares to minimize the risk of exploitation.
Exploit
Correção
RCE
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Samba
Suse
Ubuntu