Description
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Samba | samba | since 3.5.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 2:4.5.8+dfsg-2 | — |
| Debian 13 | samba | 2:4.5.8+dfsg-2 | — |
| Debian 12 | samba | 2:4.5.8+dfsg-2 | — |
| Debian 8 | samba | 2:4.2.14+dfsg-0+deb8u6 | DSA-3860-1 |
| Debian 7 | samba | 2:3.6.6-6+deb7u13 | DLA-951-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | samba | 2:4.3.11+dfsg-0ubuntu0.16.04.7 | USN-3296-1 |
| Ubuntu 14.04 LTS | samba | 2:4.3.11+dfsg-0ubuntu0.14.04.8 | USN-3296-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | ctdb +25 | 4.4.4-14.el7_3 | RHSA-2017:1270 |
| RHEL 6 | samba +12 | 3.6.23-43.el6_9 | RHSA-2017:1270 |
| RHEL 6 | samba4 +12 | 4.2.10-10.el6_9 | RHSA-2017:1271 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | samba +11 | 3.6.23-32.el6_2 | RHSA-2017:1390 |
| RHEL 7.2 EUS | samba +23 | 4.2.10-11.el7_2 | RHSA-2017:1390 |
| RHEL 7.1 EUS | ctdb +2 | 4.2.10-11.el7_2 | RHSA-2017:1390 |
| RHEL 6.7 EUS | samba +12 | 3.6.23-32.el6_7 | RHSA-2017:1390 |
| RHEL 6.6 TUS | samba +11 | 3.6.23-32.el6_6 | RHSA-2017:1390 |
| RHEL 6.6 AUS | samba +11 | 3.6.23-32.el6_6 | RHSA-2017:1390 |
| RHEL 6.5 TUS | samba +11 | 3.6.23-32.el6_5 | RHSA-2017:1390 |
| RHEL 6.5 AUS | samba +11 | 3.6.23-32.el6_5 | RHSA-2017:1390 |
| RHEL 6.4 AUS | samba +11 | 3.6.23-32.el6_4 | RHSA-2017:1390 |
| RHEL 5 ELS | samba3x +7 | 3.6.23-14.el5_11 | RHSA-2017:1272 |
| Red Hat Gluster Storage 3 | ctdb +25 | 4.4.6-5.el6rhs | RHSA-2017:1273 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | samba | 4.2.4-28.14.1 | SUSE-SU-2017:1393-1, SUSE-SU-2017:1392-1 |
| SLES 12 SP1 | samba | 4.2.4-28.14.1 | SUSE-SU-2017:1392-1 |
| SLES 12 | samba | 4.2.4-18.41.1 | SUSE-SU-2017:1396-1 |
| SLES 11 SP4 | samba +1 | 3.6.3-93.1 | SUSE-SU-2017:1391-1 |
| SLES 11 SP3 | samba +1 | 3.6.3-93.1 | SUSE-SU-2017:1391-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | samba | 4.2.4-28.14.1 | SUSE-SU-2017:1393-1, SUSE-SU-2017:1392-1 |
| SLES for SAP 12 SP1 | samba | 4.2.4-28.14.1 | SUSE-SU-2017:1392-1 |
| SLES for SAP 12 | samba | 4.2.4-18.41.1 | SUSE-SU-2017:1396-1 |
| SLES for SAP 11 SP4 | samba +1 | 3.6.3-93.1 | SUSE-SU-2017:1391-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | samba +1 | 3.6.3-93.1 | SUSE-SU-2017:1391-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | samba | 4.14.6+git.182.2205d5224e3-1.1 | openSUSE-SU-2024:11365-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.4 | samba | 4.4.14-r0 | — |
| Alpine v3.3 | samba | 4.2.14-r3 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | samba | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | ctdb +25 | 4.4.4-14.el7_3 | ELSA-2017-1270 |
| Oracle Linux 7 | samba-doc +4 | 3.6.23-43.0.1.el6_9 | ELSA-2017-1270 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Samba is_known_pipename() Arbitrary Module Load
exploit/linux/samba/is_known_pipename
Exploit-DB 2
- Samba 3.5.0 < 4.4.14/4.5.10/4.6.4 - 'is_known_pipename()' Arbitrary Module Load (Metasploit) EDB-42084 · remote · May 29, 2017 · verified
- Samba 3.5.0 - Remote Code Execution EDB-42060 · remote · May 24, 2017 · verified
GitHub 23 repositories · most starred shown
-
opsxcq/exploit-CVE-2017-7494 ★ 381 · May 26, 2017
SambaCry exploit and vulnerable container (CVE-2017-7494)
-
joxeankoret/CVE-2017-7494 ★ 259 · Jun 5, 2017
Remote root exploit for the SAMBA CVE-2017-7494 vulnerability
-
betab0t/cve-2017-7494 ★ 181 · May 25, 2017
Proof-of-Concept exploit for CVE-2017-7494(Samba RCE from a writable share)
-
Waffles-2/SambaCry ★ 63 · May 26, 2017
CVE-2017-7494 - Detection Scripts
-
brianwrf/SambaHunter ★ 57 · May 30, 2017
It is a simple script to exploit RCE for Samba (CVE-2017-7494 ).
-
d3fudd/CVE-2017-7494_SambaCry ★ 7 · Nov 1, 2022
SambaCry (CVE-2017-7494) exploit for Samba | bind shell without Metasploit
-
0xm4ud/noSAMBAnoCRY-CVE-2017-7494 ★ 5 · May 9, 2021
CVE-2017-7494 python exploit
-
I-Rinka/BIT-EternalBlue-for-macOS_Linux ★ 4 · May 15, 2021
Exploit CVE-2017-7494 for Net Security course final Assignment. This would reveal the vulnerability of services that run in administrative priority on Linux.
-
YonLiud/CVE-2017-7494 ★ 2 · Aug 15, 2026
SambaCry Explanation and Exploitation Demo with POC
-
Zer0d0y/Samba-CVE-2017-7494 ★ 1 · Jul 28, 2017
搭建漏洞利用测试环境
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 16
- RHSA-2017:1390 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2017:1270 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2017:1271 Red Hat Security Advisory: samba4 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-3296-1 samba vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-951-1 samba - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3860-1 samba - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:1391-1 Security update for samba SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11365-1 ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1396-1 Security update for samba SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1393-1 Security update for samba SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1392-1 Security update for samba SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2017:1273 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2017:1272 Red Hat Security Advisory: samba3x security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- SEVD-2018-095-01 Security Notification - U.motion Builder software Schneider Electric CPCERT · Feb 11, 2020
- ICSA-17-180-02 Schneider Electric U.motion Builder (Update A) CISA ICS & IT advisories · Jan 8, 2019
- ELSA-2017-1270 Important: samba security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 24, 2017
References
- 98636 vdb-entry
- DSA-3860 vendor-advisory
- 42084 exploit
- RHSA-2017:1270 vendor-advisory
- https://www.samba.org/samba/security/CVE-2017-7494.html
- https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-095-01+Security+Notification+Umotion+V1.1.pdf&p_Doc_Ref=SEVD-2018-095-01
- RHSA-2017:1390 vendor-advisory
- 1038552 vdb-entry
- RHSA-2017:1273 vendor-advisory
- RHSA-2017:1271 vendor-advisory
- GLSA-201805-07 vendor-advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03759en_us
- RHSA-2017:1272 vendor-advisory
- https://security.netapp.com/advisory/ntap-20170524-0001/
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us
- 42060 exploit