Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ?

[robertscally]

Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ?

Apparently its a 7 year old Samba vulnerability:

http://systemini.net/index.php/community/files/33-gc/5078-samba-users-urged-to-patch-7-year-old-remo... 

Is there a patch to fix this for Alfresco Community Edition?

[afaust · Accepted solution]

Alfresco has nothing to do with the Samba product line - except that it includes a Java-based implementation of the SMB protocol that is completely separate / distinct from the implementation found in Samba.

I am reluctant to give any answer that might be taken as conclusive. For one thing, Alfresco SMB support works very different from actual file server SMB. As far as I know, the implementation will not be able to touch any files on the operating system layer, since the SMB support is backed by the logical database-backed, "virtual" file system of Alfresco. For that reason it should not be possible to trigger remote code execution on any well known server binaries. Furthermore, the implementation will treat any file content as generic blobs, and not load any of them as executable components within the Java runtime.

‌: Maybe you could check with Engineering and provide an "official" response?

[robertscally]

Ok thanks for that explanation Axel. I was unsure whether or not Alfresco used its own version of Samba or if it used the Samba installed on the server.

Would be great to have the "official" response also.

[resplin]

Axel Faust‌ gave an excellent explanation. We won't have the same vulnerability exposure as the Samba project.

[robertscally]

That is good to hear Richard. Thanks.