CVE-2017-7494
Samba Remote Code Execution Vulnerability
Description
CVE-2017-7494 is a critical remote code execution vulnerability in Samba, the widely used open-source implementation of the SMB/CIFS networking protocol. Affecting Samba versions from 3.5.0 up to (but not including) 4.6.4, 4.5.10, and 4.4.14, this code injection flaw allows a malicious client to upload a shared library to a writable share and then force the server to load and execute it. CVE-2017-7494 has been confirmed as actively exploited in the wild and is associated with known ransomware campaigns, making it a high-priority remediation target. With an EPSS score of 0.94 (99th percentile) and its inclusion in CISA's Known Exploited Vulnerabilities catalog, organizations running vulnerable Samba versions face an immediate risk of full server compromise.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| samba | samba | >= 3.5.0, < 4.4.0; >= 4.4.0, < 4.4.14; >= 4.5.0, < 4.5.10; >= 4.6.0, < 4.6.4 |
| debian | debian linux | 8.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.debian.org/security/2017/dsa-3860(Third Party Advisory)
- http://www.securityfocus.com/bid/98636(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038552(Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2017:1270(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2017:1271(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2017:1272(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2017:1273(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2017:1390(Third Party Advisory)
- https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01(Third Party Advisory)
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us(Third Party Advisory)
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us(Third Party Advisory)
- https://security.gentoo.org/glsa/201805-07(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20170524-0001/(Third Party Advisory)
- https://www.exploit-db.com/exploits/42060/(Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42084/(Third Party Advisory, VDB Entry)
- https://www.samba.org/samba/security/CVE-2017-7494.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
In the context of CVE-2017-7494, the Samba server fails to properly restrict the loading of shared libraries from writable SMB shares. An attacker with write access to any share can upload a malicious shared library file and then send a specially crafted request that causes the Samba daemon to load and execute the attacker-controlled code with the privileges of the Samba process.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2017-7494 is remotely exploitable without physical access, requires no authentication, and demands no user interaction, making it an extremely dangerous vulnerability that can be exploited in fully automated attacks. Rated CRITICAL with a CVSS score of 9.8, successful exploitation results in high impact to confidentiality, integrity, and availability — an attacker gains arbitrary code execution on the Samba server, potentially with root privileges depending on the daemon configuration. This vulnerability has been associated with known ransomware campaigns (sometimes dubbed "SambaCry" or "EternalRed"), which dramatically increases the real-world risk for exposed systems. The EPSS score of 0.94 (99th percentile) confirms an extremely high probability of exploitation, and public exploit code is readily available, making this one of the most actively targeted Samba vulnerabilities in recent years.
Exploit Maturity
Public exploit code is widely available for CVE-2017-7494 via Exploit-DB #42060 and Exploit-DB #42084, providing ready-to-use proof-of-concept tools for remote code execution against vulnerable Samba servers. CISA has confirmed active exploitation by including this vulnerability in its Known Exploited Vulnerabilities catalog with a remediation deadline of April 20, 2023. The vulnerability has been linked to ransomware campaigns and cryptocurrency mining operations, with the EPSS score of 0.94 (99th percentile) reflecting the mature and widespread nature of exploitation tools targeting this flaw.
Remediation
- Apply vendor patches immediately by upgrading Samba to version 4.6.4, 4.5.10, or 4.4.14 (or later), as detailed in the official Samba security advisory. If patching is not possible, discontinue use of the affected Samba versions.
- As a temporary mitigation, add the parameter to the section of your Samba configuration file (smb.conf) and restart the Samba service. This prevents clients from accessing named pipe endpoints needed to exploit the vulnerability, though it may impact some Windows client functionality.
- Restrict writable share access by removing anonymous or guest write permissions from all Samba shares. Ensure that only authenticated, authorized users can write to shares, and apply filesystem-level permissions to prevent uploading of shared library (.so) files to share directories.
- Monitor Samba logs and network traffic for indicators of compromise, including unusual shared library uploads to writable shares, unexpected named pipe access, and connections from known malicious IP addresses. Deploy intrusion detection rules to alert on SMB exploitation attempts.
- Segment Samba servers from the broader network using firewall rules that restrict SMB traffic (ports 139, 445) to only trusted client subnets. Consider disabling SMBv1 where possible and auditing all externally accessible SMB services.
Technical Details
CVE-2017-7494 is a code injection vulnerability (CWE-94) in the Samba server's handling of shared library loading via SMB named pipes. The flaw exists because Samba allows clients to specify an arbitrary path when requesting the server to load a shared library module through an IPC mechanism, and when a writable share is available, an attacker can first upload a malicious .so file and then trigger its execution by sending a crafted IPC request referencing the uploaded library's server-side path. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case exploitability profile: network-accessible, low complexity, no privileges required, and no user interaction needed. The Samba daemon typically runs as root on Linux/Unix systems, meaning successful exploitation grants the attacker root-level code execution on the target server. This vulnerability affects a very wide range of Samba versions spanning from 3.5.0 (released in 2010) through the unpatched 4.6.x, 4.5.x, and 4.4.x branches, creating a large attack surface across enterprise and embedded Linux deployments.
Frequently Asked Questions
What is CVE-2017-7494?
CVE-2017-7494, also known as "SambaCry" or "EternalRed," is a critical remote code execution vulnerability in the Samba file sharing server that allows unauthenticated attackers to upload and execute malicious code on vulnerable systems through writable SMB shares.
How severe is CVE-2017-7494?
With a CVSS score of 9.8 (CRITICAL) and an EPSS score of 0.94, this is one of the most severe Samba vulnerabilities ever disclosed. It requires no authentication, no user interaction, and has been linked to ransomware campaigns.
Which versions of Samba are affected?
Samba versions from 3.5.0 (released in 2010) up to 4.6.3, 4.5.9, and 4.4.13 are vulnerable. Fixed versions are 4.6.4, 4.5.10, and 4.4.14.
Has CVE-2017-7494 been used in ransomware attacks?
Yes. CISA has confirmed that CVE-2017-7494 is associated with known ransomware campaigns. The vulnerability has been exploited for both ransomware deployment and cryptocurrency mining operations.
What is the quickest way to mitigate CVE-2017-7494?
The fastest interim mitigation is to add "nt pipe support = no" to the [global] section of smb.conf and restart Samba. However, this should be followed by a full upgrade to a patched Samba version as soon as possible.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.