CVE-2017-14746: Use After Free
As per upstream advisory:
All versions of Samba from 4.0.0 onwards are vulnerable to a use after free vulnerability, where a malicious SMB1 request can be used to control the contents of heap memory via a deallocated heap pointer. It is possible this may be used to compromise the SMB server.
Other sources
Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14746?
CVE-2017-14746 is considered a critical vulnerability due to its potential to allow an attacker to control heap memory through malicious SMB1 requests.
How do I fix CVE-2017-14746?
To fix CVE-2017-14746, upgrade to a patched version of Samba that is above 4.5.15 or apply relevant updates provided by your operating system vendor.
Which versions of Samba are vulnerable to CVE-2017-14746?
All versions of Samba from 4.0.0 onwards, up to 4.5.15, are vulnerable to CVE-2017-14746.
What types of systems are affected by CVE-2017-14746?
CVE-2017-14746 affects Samba installations on various platforms including Debian, Ubuntu, and Red Hat Linux.
Can CVE-2017-14746 be exploited remotely?
Yes, CVE-2017-14746 can potentially be exploited remotely through malicious SMB1 requests targeting the Samba server.