Cisco Security Advisory-
On May 24, 2017, the Samba team disclosed a vulnerability in Samba server software that could allow an authenticated attacker to execute arbitrary code remotely on a targeted system.
This vulnerability has been assigned CVE ID CVE-2017-7494
This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170530-samba
-
Cisco investigated its product line to determine which products may be affected by these vulnerabilities and the impact on each affected product. Refer to the Vulnerable Products and Products Confirmed Not Vulnerable sections of this advisory for information about whether a product is affected.
The Vulnerable Products section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Vulnerable Products
The following table lists Cisco products that are affected by the vulnerability described in this advisory.
Product Cisco Bug ID Fixed Release Availability Network Management and Provisioning Cisco Network Analysis Module CSCve61674
Video, Streaming, TelePresence, and Transcoding Devices Cisco MXE 3500 Series Media Experience Engines CSCve61675 Patch for 3.5.2 (17-Jul-2017) Cisco Video Surveillance Media Server CSCve61680 10.0.0 (October 2017)
Products Confirmed Not Vulnerable
Cisco investigated its product line to determine which products may be affected by this vulnerability and the impact on each affected product. Cisco has confirmed that this vulnerability does not affect the following Cisco products.
Network Application, Service, and Acceleration
- Cisco Application and Content Networking System (ACNS)
- Cisco Wide Area Application Services (WAAS)
Network and Content Security Devices
- Cisco Content Security Management Appliance
- Cisco Identity Services Engine (ISE)
- Cisco Web Security Appliance (WSA)
Network Management and Provisioning
- Lancope Stealthwatch Endpoint Concentrator
- Lancope Stealthwatch FlowCollector NetFlow
- Lancope Stealthwatch FlowCollector sFlow
- Lancope Stealthwatch FlowSensor
- Lancope Stealthwatch SMC
- Lancope Stealthwatch UDP Director
Routing and Switching - Small Business
- Cisco Small Business RV Series RV320 Dual Gigabit WAN VPN Router
Unified Computing
- Cisco Common Services Platform Collector
Voice and Unified Communications Devices
- Cisco IP Interoperability and Collaboration System (IPICS)
Video, Streaming, TelePresence, and Transcoding Devices
- Cisco Digital Media Manager
- Cisco Expressway Series
- Cisco TelePresence Video Communication Server (VCS)
- Cisco VDS Recorder
- Cisco VDS-TV Caching Nodes
- Cisco VDS-TV Streamer
- Cisco VDS-TV Vault
-
A vulnerability in Samba could allow an authenticated, remote attacker to execute arbitrary code.
The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker who has access to a writable share on a targeted system could upload malicious, shared libraries to the writable share. When the targeted system loads and execute the malicious, shared libraries, the attacker could execute arbitrary code, which could be used to conduct further attacks.
-
To help detect exploitation of this vulnerability, Cisco has released Snort rules with SIDs 43002 through 43004. The alert is generated by SID 43004.
-
Any workarounds, if available, are documented in the Cisco bugs, which are accessible through the Cisco Bug Search Tool.
-
When Cisco releases free software updates, customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.htmlAdditionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to upgrade contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.htmlCustomers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
Fixed Releases
To determine the affected and fixed releases for each vulnerable product, refer to the Cisco bug identified for the product. These bugs are listed in the table in the Vulnerable Products section of this advisory. Cisco bugs are accessible through the Cisco Bug Search Tool.
-
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
-
This vulnerability was disclosed by the Samba Team in the following announcement: https://www.samba.org/samba/security/CVE-2017-7494.html
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show LessVersion Description Section Status Date 1.5 Updated list of products confirmed not vulnerable. Indicated that product line investigation is complete. Affected Products, Products Confirmed Not Vulnerable, Fixed Releases Final 2017-July-11 1.4 Updated product lists. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable Final 2017-July-07 1.3 Updated product lists. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable Interim 2017-June-12 1.2 Updated product lists. Affected Products, Products Confirmed Not Vulnerable Interim 2017-June-02 1.1 Updated product lists. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable Interim 2017-June-01 1.0 Initial public release. — Interim 2017-May-30
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.