CVE-2017-15275: Buffer Overflow
As per upstream samba advisory:
All versions of Samba from 3.6.0 onwards are vulnerable to a heap memory information leak, where server allocated heap memory may be returned to the client without being cleared.
There is no known vulnerability associated with this error, but uncleared heap memory may contain previously used data that may help an attacker compromise the server via other methods. Uncleared heap memory may potentially contain password hashes or other high-value data.
Other sources
Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15275?
CVE-2017-15275 is considered a moderate severity vulnerability due to the potential exposure of sensitive data through an information leak.
How do I fix CVE-2017-15275?
To fix CVE-2017-15275, ensure that your Samba version is updated to a patched release that addresses this vulnerability.
What versions of Samba are affected by CVE-2017-15275?
CVE-2017-15275 affects all Samba versions from 3.6.0 onwards, up to but not including the patched versions.
Is there a known exploit for CVE-2017-15275?
There is currently no known exploit associated with CVE-2017-15275, but the vulnerability does allow for potential data exposure.
What should I do if I cannot update Samba for CVE-2017-15275?
If you cannot update Samba for CVE-2017-15275, consider implementing additional security controls to mitigate the risk of information exposure.