Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2017.1395.4 Vulnerability in Samba Affecting Cisco Products: May 2017 17 July 2017 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Cisco Network Analysis Module Cisco MXE 3500 Series Media Experience Engines Cisco Video Surveillance Media Server Publisher: Cisco Systems Operating System: Network Appliance Virtualisation Impact/Access: Root Compromise -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2017-7494 Reference: ESB-2017.1345 ESB-2017.1330 ESB-2017.1329 ESB-2017.1328 Original Bulletin: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170530-samba Revision History: July 17 2017: Updated list of products confirmed not vulnerable. July 10 2017: Updated product lists June 7 2017: Updated product lists June 1 2017: Initial Release - --------------------------BEGIN INCLUDED TEXT-------------------- Vulnerability in Samba Affecting Cisco Products: May 2017 High Advisory ID: cisco-sa-20170530-samba First Published: 2017 May 30 19:30 GMT Last Updated: 2017 July 11 13:47 GMT Version 1.5: Final Workarounds: Yes CVE-2017-7494 CWE-20 Summary On May 24, 2017, the Samba team disclosed a vulnerability in Samba server software that could allow an authenticated attacker to execute arbitrary code remotely on a targeted system. This vulnerability has been assigned CVE ID CVE-2017-7494 This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170530-samba Affected Products Cisco investigated its product line to determine which products may be affected by these vulnerabilities and the impact on each affected product. Refer to the Vulnerable Products and Products Confirmed Not Vulnerable sections of this advisory for information about whether a product is affected. The Vulnerable Products section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases. Vulnerable Products The following table lists Cisco products that are affected by the vulnerability described in this advisory. Product Cisco Bug ID Fixed Release Availability Network Management and Provisioning Cisco Network Analysis Module CSCve61674 Video, Streaming, TelePresence, and Transcoding Devices Cisco MXE 3500 Series Media Experience Engines CSCve61675 Patch for 3.5.2 (17-Jul-2017) Cisco Video Surveillance Media Server CSCve61680 10.0.0 (October 2017) Products Confirmed Not Vulnerable Cisco investigated its product line to determine which products may be affected by this vulnerability and the impact on each affected product. Cisco has confirmed that this vulnerability does not affect the following Cisco products. Network Application, Service, and Acceleration Cisco Application and Content Networking System (ACNS) Cisco Wide Area Application Services (WAAS) Network and Content Security Devices Cisco Content Security Management Appliance Cisco Identity Services Engine (ISE) Cisco Web Security Appliance (WSA) Network Management and Provisioning Lancope Stealthwatch Endpoint Concentrator Lancope Stealthwatch FlowCollector NetFlow Lancope Stealthwatch FlowCollector sFlow Lancope Stealthwatch FlowSensor Lancope Stealthwatch SMC Lancope Stealthwatch UDP Director Routing and Switching - Small Business Cisco Small Business RV Series RV320 Dual Gigabit WAN VPN Router Unified Computing Cisco Common Services Platform Collector Voice and Unified Communications Devices Cisco IP Interoperability and Collaboration System (IPICS) Video, Streaming, TelePresence, and Transcoding Devices Cisco Digital Media Manager Cisco Expressway Series Cisco TelePresence Video Communication Server (VCS) Cisco VDS Recorder Cisco VDS-TV Caching Nodes Cisco VDS-TV Streamer Cisco VDS-TV Vault Details A vulnerability in Samba could allow an authenticated, remote attacker to execute arbitrary code. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker who has access to a writable share on a targeted system could upload malicious, shared libraries to the writable share. When the targeted system loads and execute the malicious, shared libraries, the attacker could execute arbitrary code, which could be used to conduct further attacks. Indicators of Compromise To help detect exploitation of this vulnerability, Cisco has released Snort rules with SIDs 43002 through 43004. The alert is generated by SID 43004. Workarounds Any workarounds, if available, are documented in the Cisco bugs, which are accessible through the Cisco Bug Search Tool. Fixed Software When Cisco releases free software updates, customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license: http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades. When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to upgrade contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Customers Without Service Contracts Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade. Fixed Releases To determine the affected and fixed releases for each vulnerable product, refer to the Cisco bug identified for the product. These bugs are listed in the table in the Vulnerable Products section of this advisory. Cisco bugs are accessible through the Cisco Bug Search Tool. Exploitation and Public Announcements The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory. Source This vulnerability was disclosed by the Samba Team in the following announcement: https://www.samba.org/samba/security/CVE-2017-7494.html URL https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170530-samba Revision History Version Description Section Status Date 1.5 Updated list of products confirmed not vulnerable. Indicated that product line investigation is complete. Affected Products, Products Confirmed Not Vulnerable, Fixed Releases Final 2017-July-11 1.4 Updated product lists. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable Final 2017-July-07 1.3 Updated product lists. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable Interim 2017-June-12 1.2 Updated product lists. Affected Products, Products Confirmed Not Vulnerable Interim 2017-June-02 1.1 Updated product lists. Affected Products, Vulnerable Products, Products Confirmed Not Vulnerable Interim 2017-June-01 1 Initial public release. Interim 2017-May-30 LEGAL DISCLAIMER THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWWwqIYx+lLeg9Ub1AQirnQ//bOCkZt3dxkobqnA+luGs5HqmbXjQN42F Ah8ijJa/cUTpoZuGM15Ec84Yi7zihWYHlhm5M9TnJpEZ7aFbW7PovN51B3q3X1FJ RZ2MYcq/zoUpPsFnDQrHSSaoq7hlhpDRviqI/oaI/TwdkST2fX//aRagaZ29K5Av zkf07wdIdHYycsg+7JMZMkRdHnJr2A/8NrX0Yg+E6+0Q4Wv+ZjjUB3KKr5ApEu+F q0b5ryJJby3yvbKb020gJRZt9HxcoC4SkKaiRaL3eoZnQKuWBSnYad0U5aHxRurm 8lCa/5gfa9n2WQSlU0F/0prCi71875QORNvXDN49hVcvXximiW20Vmw13QhNKj0o 9Z/MHtVxKZ9cVp5/Op7i95dzO4QVjX+Mn9l8l/Uaf0yriyyFya2SBRC9hOxpP2P6 d7+HOE23TGLHKwEDvf885IA9T/DjCN6D0tqTPWAS/XYvoOswqvEKcIAAoLYeu+Zl 8pi7JcVze5bpNIofsPzb+bw2XMZHGTmVu9hZyO+LFVvialhb/KrrR4cwtjfE6YTS QQU017PbLpmcQbvbQdDcPrIpYCK9N7ORiHztlwWfco7ug5P8C+KXJvYsk1dcdGUe IZdwuGZr1JXAuB+h/gKoQ0ffhQmJ1xqxQhX/UkakJw/vTfRBfk7LwwikAyjZHZHx QWW/8QcDmxY= =zWcA -----END PGP SIGNATURE-----