high 7.5

CVE-2017-2619 in the critical feed json

Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the ser…

published 2018-03-12 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11780

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 11.0%; EPSS 11.0% chance of exploitation in 30 days, percentile 95%
public exploits: 1; Exploit-DB

Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.

Patch / fix

fixed in 1 distros 6

samba samba 4.4.12, 4.5.7, 4.6.1

debian ubuntu red hat suse opensuse alpine

samba Debian 14, Debian 13, Debian 12 2:4.5.6+dfsg-2

debian advisories DEBIAN-CVE-2017-2619

samba Ubuntu 14.04 LTS 2:4.3.11+dfsg-0ubuntu0.14.04.6
samba Ubuntu 16.04 LTS 2:4.3.11+dfsg-0ubuntu0.16.04.5

ubuntu advisories UBUNTU-CVE-2017-2619

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

samba RHEL 6 3.6.23-45.el6_9
samba-swat RHEL 6 3.6.23-45.el6_9
libsmbclient RHEL 6 3.6.23-45.el6_9
samba-client RHEL 6 3.6.23-45.el6_9
samba-common RHEL 6 3.6.23-45.el6_9
samba-winbind RHEL 6 3.6.23-45.el6_9
samba-glusterfs RHEL 6 3.6.23-45.el6_9
samba-domainjoin-gui RHEL 6 3.6.23-45.el6_9

red hat advisories RHSA-2017:2789 RHSA-2017:2338 RHSA-2017:1265 RHSA-2017:2778

samba SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +4 more 3.6.3-90.1
samba SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for Raspberry Pi 12 SP2 +7 more 4.2.4-28.11.1
samba SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +3 more 4.4.2-38.3.1
samba SLES for SAP 12, SLES 12-LTSS, SLE High Availability Extension 12 4.2.4-18.35.1
samba SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for Raspberry Pi 12 SP2 +7 more 4.2.4-28.8.2
samba SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +3 more 4.4.2-36.2
samba SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 3.6.3-87.1
samba SLES for SAP 12, SLES 12-LTSS 4.2.4-18.38.1

suse advisories SUSE-SU-2017:1216-1 SUSE-RU-2017:1218-1 SUSE-RU-2017:1217-1 SUSE-RU-2017:1219-1 SUSE-SU-2017:0862-1 SUSE-SU-2017:0859-1

samba openSUSE Tumbleweed 4.14.6+git.182.2205d5224e3-1.1

opensuse advisories openSUSE-SU-2024:11365-1

samba Alpine 3.24, Alpine 3.23, Alpine 3.22 +16 more 4.6.1-r0
samba Alpine 3.3, Alpine 3.2 4.2.14-r2
samba Alpine 3.4 4.4.5-r3
samba Alpine 3.5 4.5.7-r0

alpine advisories ALPINE-CVE-2017-2619

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-2619 updated 2026-11-07 cvss 5.9

samba: symlink race permits opening files outside share directory

Red Hat Enterprise Linux 5 samba, samba3x
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux 6 samba4, samba4-dc, samba4-libs, samba4-pidl, samba4-swat, samba4-test, +7 more
affected: workaround, no fix available
Red Hat Enterprise Linux Client (v. 7) samba 4.4.4-13.el7_3, samba-libs 4.4.4-13.el7_3, libwbclient 4.4.4-13.el7_3, libsmbclient 4.4.4-13.el7_3, samba-client 4.4.4-13.el7_3, samba-common 4.4.4-13.el7_3, +7 more Red Hat Enterprise Linux Client Optional (v. 7) samba 4.4.4-13.el7_3, samba-dc 4.4.4-13.el7_3, samba-pidl 4.4.4-13.el7_3, samba-test 4.4.4-13.el7_3, samba-python 4.4.4-13.el7_3, samba-dc-libs 4.4.4-13.el7_3, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) samba 4.4.4-13.el7_3, samba-libs 4.4.4-13.el7_3, libwbclient 4.4.4-13.el7_3, libsmbclient 4.4.4-13.el7_3, samba-client 4.4.4-13.el7_3, samba-common 4.4.4-13.el7_3, +6 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) samba 4.4.4-13.el7_3, samba-dc 4.4.4-13.el7_3, samba-pidl 4.4.4-13.el7_3, samba-test 4.4.4-13.el7_3, samba-python 4.4.4-13.el7_3, samba-dc-libs 4.4.4-13.el7_3, +4 more
fixed: vendor fix RHSA-2017:1265
Red Hat Enterprise Linux Desktop (v. 6) samba 3.6.23-45.el6_9, libsmbclient 3.6.23-45.el6_9, samba-client 3.6.23-45.el6_9, samba-common 3.6.23-45.el6_9, samba-winbind 3.6.23-45.el6_9, samba-winbind-clients 3.6.23-45.el6_9 Red Hat Enterprise Linux Desktop Optional (v. 6) samba 3.6.23-45.el6_9, samba-swat 3.6.23-45.el6_9, samba-glusterfs 3.6.23-45.el6_9, samba-domainjoin-gui 3.6.23-45.el6_9, samba-winbind-krb5-locator 3.6.23-45.el6_9 Red Hat Enterprise Linux HPC Node (v. 6) samba 3.6.23-45.el6_9, samba-client 3.6.23-45.el6_9, samba-common 3.6.23-45.el6_9, samba-winbind 3.6.23-45.el6_9, samba-winbind-clients 3.6.23-45.el6_9 Red Hat Enterprise Linux HPC Node Optional (v. 6) samba 3.6.23-45.el6_9, samba-swat 3.6.23-45.el6_9, libsmbclient 3.6.23-45.el6_9, samba-glusterfs 3.6.23-45.el6_9, samba-domainjoin-gui 3.6.23-45.el6_9, samba-winbind-krb5-locator 3.6.23-45.el6_9 Red Hat Enterprise Linux Server (v. 6) samba 3.6.23-45.el6_9, libsmbclient 3.6.23-45.el6_9, samba-client 3.6.23-45.el6_9, samba-common 3.6.23-45.el6_9, samba-winbind 3.6.23-45.el6_9, samba-winbind-clients 3.6.23-45.el6_9
fixed: vendor fix RHSA-2017:2789
Red Hat Enterprise Linux Server (v. 7) samba 4.4.4-13.el7_3, samba-libs 4.4.4-13.el7_3, libwbclient 4.4.4-13.el7_3, libsmbclient 4.4.4-13.el7_3, samba-client 4.4.4-13.el7_3, samba-common 4.4.4-13.el7_3, +8 more
fixed: vendor fix RHSA-2017:1265
Red Hat Enterprise Linux Server Optional (v. 6) samba-swat 3.6.23-45.el6_9, samba-glusterfs 3.6.23-45.el6_9, samba-domainjoin-gui 3.6.23-45.el6_9, samba-winbind-krb5-locator 3.6.23-45.el6_9
fixed: vendor fix RHSA-2017:2789
Red Hat Enterprise Linux Server Optional (v. 7) samba-dc 4.4.4-13.el7_3, samba-pidl 4.4.4-13.el7_3, samba-test 4.4.4-13.el7_3, samba-python 4.4.4-13.el7_3, samba-dc-libs 4.4.4-13.el7_3, samba-test-libs 4.4.4-13.el7_3, +2 more Red Hat Enterprise Linux Server Resilient Storage (v. 7) ctdb 4.4.4-13.el7_3, ctdb-tests 4.4.4-13.el7_3
fixed: vendor fix RHSA-2017:1265
Red Hat Enterprise Linux Workstation (v. 6) samba 3.6.23-45.el6_9, libsmbclient 3.6.23-45.el6_9, samba-client 3.6.23-45.el6_9, samba-common 3.6.23-45.el6_9, samba-winbind 3.6.23-45.el6_9, samba-winbind-clients 3.6.23-45.el6_9
fixed: vendor fix RHSA-2017:2789

show 5 more

Red Hat Enterprise Linux Workstation (v. 7) samba 4.4.4-13.el7_3, samba-libs 4.4.4-13.el7_3, libwbclient 4.4.4-13.el7_3, libsmbclient 4.4.4-13.el7_3, samba-client 4.4.4-13.el7_3, samba-common 4.4.4-13.el7_3, +8 more
fixed: vendor fix RHSA-2017:1265
Red Hat Enterprise Linux Workstation Optional (v. 6) samba-swat 3.6.23-45.el6_9, samba-glusterfs 3.6.23-45.el6_9, samba-domainjoin-gui 3.6.23-45.el6_9, samba-winbind-krb5-locator 3.6.23-45.el6_9
fixed: vendor fix RHSA-2017:2789
Red Hat Enterprise Linux Workstation Optional (v. 7) samba-dc 4.4.4-13.el7_3, samba-pidl 4.4.4-13.el7_3, samba-test 4.4.4-13.el7_3, samba-dc-libs 4.4.4-13.el7_3, samba-test-libs 4.4.4-13.el7_3, samba-vfs-glusterfs 4.4.4-13.el7_3, +1 more
fixed: vendor fix RHSA-2017:1265
Red Hat Gluster 3.2 Samba on RHEL-7 ctdb 4.6.3-4.el7rhgs, samba 4.6.3-4.el7rhgs, samba-dc 4.6.3-4.el7rhgs, ctdb-tests 4.6.3-4.el7rhgs, samba-libs 4.6.3-4.el7rhgs, samba-pidl 4.6.3-4.el7rhgs, +17 more
fixed: vendor fix RHSA-2017:2338
Red Hat Gluster 3.3 Samba on RHEL-6 ctdb 4.6.3-5.el6rhs, samba 4.6.3-5.el6rhs, pyldb 1.1.29-1.el6rhs, libldb 1.1.29-1.el6rhs, pytalloc 2.1.9-1.el6rhs, samba-dc 4.6.3-5.el6rhs, +27 more
fixed: vendor fix RHSA-2017:2778

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2017-03-27 First public exploit (EDB-41740)
2018-03-12 Published

Exploit prediction

11.02% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-41740 Samba 4.5.2 - Symlink Race Permits Opening Files Outside Share Directory remote, 2017-03-27

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.0	AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected products

Samba samba

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
CWE-59 Improper Link Resolution Before File Access

References

exploit-db.com /exploits/41740/
exploit, third-party-advisory, vdb-entry
access.redhat.com /errata/RHSA-2017:2778
vendor-advisory, third-party-advisory
debian.org /security/2017/dsa-3816
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:2338
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:1265
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2017:2789
vendor-advisory, third-party-advisory
samba.org /samba/security/CVE-2017-2619.html
vendor-advisory
securityfocus.com /bid/97033
vdb-entry, third-party-advisory
securitytracker.com /id/1038117
vdb-entry, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1429472
issue-tracking, third-party-advisory
h20566.www2.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us
third-party-advisory

Sources

CVE List CVE-2017-2619
NVD CVE-2017-2619

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary