CVE Database›CVE-2017-14746

CVE-2017-14746

samba: Use-after-free in processing SMB1 requests

Loading…

Severity

Important

Red Hat Product Security

6.3

CVSS 3.0

Review impact separately from score.

Published · November 21, 2017

Updated · May 13, 2026

Description

A use-after-free flaw was found in the way samba servers handled certain SMB1 requests. An unauthenticated attacker could send specially-crafted SMB1 requests to cause the server to crash or execute arbitrary code.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Prevent SMB1 access to the server by setting the parameter:

"server min protocol = SMB2"

to the [global] section of your smb.conf and restart smbd. This prevents and SMB1 access to the server. Note this could cause older clients to be unable to connect to the server.

CVSS / CWE

CVSS 3.0 · 6.3
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE not specified