Summary

• On May 24, 2017, the Samba team disclosed a vulnerability in Samba server software that could allow an authenticated attacker to execute arbitrary code remotely on a targeted system.
  
  This vulnerability has been assigned CVE ID CVE-2017-7494
  
  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170530-samba

Affected Products

• Cisco investigated its product line to determine which products may be affected by these vulnerabilities and the impact on each affected product. Refer to the Vulnerable Products and Products Confirmed Not Vulnerable sections of this advisory for information about whether a product is affected.
  
  The Vulnerable Products section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
  

  Vulnerable Products

  The following table lists Cisco products that are affected by the vulnerability described in this advisory.

  Product	Cisco Bug ID	Fixed Release Availability
  Network Management and Provisioning
  Cisco Network Analysis Module	CSCve61674
  Video, Streaming, TelePresence, and Transcoding Devices
  Cisco MXE 3500 Series Media Experience Engines	CSCve61675	Patch for 3.5.2 (17-Jul-2017)
  Cisco Video Surveillance Media Server	CSCve61680	10.0.0 (October 2017)

  
  

  Products Confirmed Not Vulnerable

  Cisco investigated its product line to determine which products may be affected by this vulnerability and the impact on each affected product. Cisco has confirmed that this vulnerability does not affect the following Cisco products.

  Network Application, Service, and Acceleration
  

  • Cisco Application and Content Networking System (ACNS)
  • Cisco Wide Area Application Services (WAAS)

  
  Network and Content Security Devices
  

  • Cisco Content Security Management Appliance
  • Cisco Identity Services Engine (ISE)
  • Cisco Web Security Appliance (WSA)

  
  Network Management and Provisioning
  

  • Lancope Stealthwatch Endpoint Concentrator
  • Lancope Stealthwatch FlowCollector NetFlow
  • Lancope Stealthwatch FlowCollector sFlow
  • Lancope Stealthwatch FlowSensor
  • Lancope Stealthwatch SMC
  • Lancope Stealthwatch UDP Director

  
  Routing and Switching - Small Business
  

  • Cisco Small Business RV Series RV320 Dual Gigabit WAN VPN Router

  
  Unified Computing
  

  • Cisco Common Services Platform Collector

  
  Voice and Unified Communications Devices
  

  • Cisco IP Interoperability and Collaboration System (IPICS)

  
  Video, Streaming, TelePresence, and Transcoding Devices
  

  • Cisco Digital Media Manager
  • Cisco Expressway Series
  • Cisco TelePresence Video Communication Server (VCS)
  • Cisco VDS Recorder
  • Cisco VDS-TV Caching Nodes
  • Cisco VDS-TV Streamer
  • Cisco VDS-TV Vault

Details

• A vulnerability in Samba could allow an authenticated, remote attacker to execute arbitrary code.
  
  The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker who has access to a writable share on a targeted system could upload malicious, shared libraries to the writable share. When the targeted system loads and execute the malicious, shared libraries, the attacker could execute arbitrary code, which could be used to conduct further attacks.

Indicators of Compromise

• To help detect exploitation of this vulnerability, Cisco has released Snort rules with SIDs 43002 through 43004. The alert is generated by SID 43004.

Workarounds

• Any workarounds, if available, are documented in the Cisco bugs, which are accessible through the Cisco Bug Search Tool.

Fixed Software

• When Cisco releases free software updates, customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
  http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html

  Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.

  When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.

  In all cases, customers should ensure that the devices to upgrade contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

  Customers Without Service Contracts

  Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC:
  http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html

  Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.

  Fixed Releases

  To determine the affected and fixed releases for each vulnerable product, refer to the Cisco bug identified for the product. These bugs are listed in the table in the Vulnerable Products section of this advisory. Cisco bugs are accessible through the Cisco Bug Search Tool.

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Source

• This vulnerability was disclosed by the Samba Team in the following announcement: https://www.samba.org/samba/security/CVE-2017-7494.html

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170530-samba

Revision History

• Version	Description	Section	Status	Date
  1.5	Updated list of products confirmed not vulnerable. Indicated that product line investigation is complete.	Affected Products, Products Confirmed Not Vulnerable, Fixed Releases	Final	2017-July-11
  1.4	Updated product lists.	Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable	Final	2017-July-07
  1.3	Updated product lists.	Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable	Interim	2017-June-12
  1.2	Updated product lists.	Affected Products, Products Confirmed Not Vulnerable	Interim	2017-June-02
  1.1	Updated product lists.	Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable	Interim	2017-June-01
  1.0	Initial public release.	-	Interim	2017-May-30

  Show Less