Vulnerability Description
smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Samba | <= 4.4.9 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Server Aus | 7.4 |
| Redhat | Enterprise Linux Server Eus | 7.4 |
| Redhat | Enterprise Linux Server Tus | 7.6 |
| Redhat | Enterprise Linux Workstation | 7.0 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/99455Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1950Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2338Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2778Third Party Advisory
- https://bugs.debian.org/864291ExploitIssue TrackingPatch
- https://bugzilla.samba.org/show_bug.cgi?id=12572ExploitIssue TrackingPatch
- https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=10c3e3923022485c720f322ca4f0ac
- https://lists.debian.org/debian-lts-announce/2019/04/msg00013.htmlThird Party Advisory
- http://www.securityfocus.com/bid/99455Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1950Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2338Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2778Third Party Advisory
- https://bugs.debian.org/864291ExploitIssue TrackingPatch
- https://bugzilla.samba.org/show_bug.cgi?id=12572ExploitIssue TrackingPatch
- https://git.samba.org/?p=samba.git%3Ba=commit%3Bh=10c3e3923022485c720f322ca4f0ac
FAQ
What is CVE-2017-9461?
CVE-2017-9461 is a vulnerability with a CVSS score of 6.5 (MEDIUM). smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling syml...
How severe is CVE-2017-9461?
CVE-2017-9461 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-9461?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Samba, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus.