Use-after-free in Samba - CVE-2017-14746

Vulnerability identifier: #VU9372

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-14746

CWE-ID: CWE-416

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error when processing SMB1 requests. A remote attacker can send a specially crafted SMB1 request to vulnerable server, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable SMB server.

Samba
Debian Linux
Arch Linux
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power
SUSE Linux
Slackware Linux
Ubuntu
Fedora
Red Hat Gluster Storage Server for On-premise
samba (Alpine package)
samba
RoboHelp

Update to version 4.5.15, 4.6.11 or 4.7.3.

samba (Alpine package) - update to 4.4.16-r1
samba - addressed in versions 4.6.11-0.fc26, 4.7.3-0.fc27

• https://www.samba.org/samba/security/CVE-2017-14746.html

• Multiple vulnerabilities in Samba
• Ubuntu update for Samba
• Debian update for samba
• Slackware Linux update for samba
• SUSE Linux update for samba
• Arch Linux update for samba
• Amazon Linux AMI update for samba
• OpenSUSE Linux update for samba
• SUSE Linux update for samba
• Gentoo update for Samba
• Red Hat update for samba4
• Red Hat update for samba
• Red Hat update for samba
• Use-after-free in samba (Alpine package)
• Fedora 27 update for samba
• Fedora 26 update for samba