CVE-2017-7494

CVE-2017-7494: Samba Remote Code Execution via Shared Library Upload (SambaCry)

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2017-7494 is a critical remote code execution (RCE) vulnerability in Samba, the widely-deployed open-source SMB/CIFS file server. A malicious client can upload a shared library to a writable Samba share and then cause the server to load and execute it, yielding full remote compromise with no authentication required.

Background

Samba implements the SMB/CIFS protocol suite, enabling Linux and Unix systems to interoperate with Windows file-sharing networks. The vulnerability resides in the server's handling of named pipes and shared library loading, specifically when the nt pipe support = yes configuration option is enabled (the default). Because Samba often runs with root privileges and exposed shares are common in enterprise and NAS environments, this flaw presents a high-impact, easily exploitable attack surface.

Root Cause

The flaw maps to CWE-94: Code Injection. Samba allows remote clients to open a named pipe and provide a path to a shared library. When processing this pipe, the server passes the client-supplied path directly to the dynamic loader via internal IPC mechanisms. If the attacker can write a malicious .so file to any writable share on the target server, they can reference that path in the pipe request, causing the Samba process to load and execute attacker-controlled code in its security context. The root cause is a lack of path validation and unsafe dynamic library loading from attacker-influenced locations.

Impact

An unauthenticated attacker can achieve arbitrary code execution as the Samba process user (often root). This enables complete system takeover, ransomware deployment, lateral movement, and data exfiltration. The vulnerability is especially severe in environments where Samba shares are internet-facing or exposed to untrusted internal networks.

Exploitation Walkthrough

Defensive / generic overview only — no weaponized exploit code.

The attack typically proceeds as follows:

1. Reconnaissance: Identify a Samba server with a writable share (e.g., via smbclient enumeration or network scanning).
2. Upload: Write a malicious shared library file to the writable share path.
3. Trigger: Open a named pipe connection to the Samba server and send a request that references the uploaded library path.
4. Execution: The Samba process loads the library, executing the attacker's payload in the server's process context.

Public exploit code was published to Exploit-DB shortly after disclosure (entries 42060 and 42084). The attack complexity is low, and reliable exploitation is possible with standard tools. This information is provided for defensive awareness only. Administrators should assume active exploitation based on the CISA KEV listing and the high EPSS score.

Affected and Patched Versions

Affected:

• Samba 3.5.0 and later, through versions before 4.6.4, 4.5.10, and 4.4.14
• Debian Linux 8.0 (with affected Samba versions)

Patched:

• Samba 4.6.4, 4.5.10, 4.4.14, and all subsequent versions

Vendors including Red Hat, SUSE, Debian, and HPE released security advisories and patched packages for their respective distributions. The specific patched versions vary by distribution; consult your vendor's security advisory for exact package numbers.

Remediation

Primary:

• Upgrade Samba to a patched version (4.6.4, 4.5.10, 4.4.14, or later).
• Apply vendor-supplied security updates (e.g., RHSA-2017:1270 through RHSA-2017:1390, DSA-3860, SUSE-SU-2017:1391-1).

Compensating Controls (if immediate patching is not possible):

• Disable nt pipe support in smb.conf by setting nt pipe support = no and restarting the Samba service. Note that this may break some Windows client functionality.
• Restrict Samba shares to authenticated users and disable anonymous/guest write access.
• Ensure Samba is not exposed to untrusted networks or the internet (block TCP/445 at the perimeter).
• Run the Samba service under a non-root account with minimal privileges where possible.

Detection

• Network: Monitor for anomalous SMB file uploads to shared directories followed by named pipe connections.
• Endpoint: Alert on unexpected .so file creation in Samba share paths and subsequent library loading by the smbd process.
• Behavioral: Look for post-exploitation indicators such as new user creation, shell execution, or network connections initiated by the Samba process.
• Threat Intelligence: Correlate with CISA KEV and EU exploited vulnerability databases.

Assessment

CVE-2017-7494 is a textbook high-severity, high-probability vulnerability. Its inclusion in the CISA Known Exploited Vulnerabilities catalog (added 2023-03-30) and an EPSS score of 0.99448 confirm near-universal exploitation in the wild. The combination of unauthenticated remote access, low attack complexity, and full CIA impact makes this a critical patching priority for any organization running legacy Samba versions.

Key lessons:

1. Default configurations like nt pipe support = yes can carry hidden risk; periodic configuration hardening reviews are essential.
2. Writable network shares remain a perennial attack vector — restrict write permissions and monitor file creation events aggressively.

References

• https://www.samba.org/samba/security/CVE-2017-7494.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7494
• http://www.debian.org/security/2017/dsa-3860
• https://access.redhat.com/errata/RHSA-2017:1270
• https://access.redhat.com/errata/RHSA-2017:1271
• https://access.redhat.com/errata/RHSA-2017:1272
• https://access.redhat.com/errata/RHSA-2017:1273
• https://access.redhat.com/errata/RHSA-2017:1390
• https://security.netapp.com/advisory/ntap-20170524-0001/
• https://security.gentoo.org/glsa/201805-07
• http://www.securityfocus.com/bid/98636
• http://www.securitytracker.com/id/1038552
• https://www.exploit-db.com/exploits/42060/
• https://www.exploit-db.com/exploits/42084/