CVE-2017-12163
CVE-2017-12163 Vulnerability Analysis & Exploit Intelligence
An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker.
Published Updated Sources: cvelistV5, redhat
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
8%
chance of exploitation in 30 days
CVSS base
4.1
MEDIUM
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Vendors (1)
Products (1)
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 4.1 | CVSS 3.0 | MEDIUM | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-200
Attack patterns reported against this CVE. The ATT&CK techniques below are inferred from its weakness class.
- T1562.003Impair Defenses: Impair Command History Logging
- T1574.006Hijack Execution Flow: Dynamic Linker Hijacking
- T1574.007Hijack Execution Flow: Path Interception by PATH Environment Variable
References
13 on the record
- h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03775en_us
x_refsource_CONFIRM
- security.netapp.com/advisory/ntap-20170921-0001/
x_refsource_CONFIRM
- access.redhat.com/errata/RHSA-2017:2790
vendor-advisory, x_refsource_REDHAT
- www.securityfocus.com/bid/100925
vdb-entry, x_refsource_BID
- www.samba.org/samba/security/CVE-2017-12163.html
x_refsource_CONFIRM
- www.synology.com/support/security/Synology_SA_17_57_Samba
x_refsource_CONFIRM
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03817en_us
x_refsource_CONFIRM
- www.debian.org/security/2017/dsa-3983
vendor-advisory, x_refsource_DEBIAN
Elsewhere on this site
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.