CVE-2017-7494

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 99,4%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada samba, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 30 Maret 2023, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.

Rincian

Terbit di NVD

30 Mei 2017

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

99,4% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Samba Remote Code Execution Vulnerability

Masuk KEV

30 Maret 2023

Tenggat CISA

20 April 2023 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.samba.org/samba/security/CVE-2017-7494.html patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494 pemerintah AS
• http://www.debian.org/security/2017/dsa-3860 advisory pihak ketiga
• http://www.securityfocus.com/bid/98636 advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1038552 advisory pihak ketiga · vdb entry
• https://access.redhat.com/errata/RHSA-2017:1270 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2017:1271 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2017:1272 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2017:1273 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2017:1390 advisory pihak ketiga
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Secur... advisory pihak ketiga
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us advisory pihak ketiga
• https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us advisory pihak ketiga
• https://security.gentoo.org/glsa/201805-07 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20170524-0001/ advisory pihak ketiga
• https://www.exploit-db.com/exploits/42060/ advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/42084/ advisory pihak ketiga · vdb entry