topic Re: Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ? in Alfresco Forum https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30136#M12816 <HTML><HEAD></HEAD><BODY><P>Alfresco has nothing to do with the Samba product line - except that it includes a Java-based implementation of the SMB protocol that is completely separate / distinct from the implementation found in Samba.</P><P>I am reluctant to give any answer that might be taken as conclusive. For one thing, Alfresco SMB support works very different from actual file server SMB. As far as I know, the implementation will not be able to touch any files on the operating system layer, since the SMB support is backed by the logical database-backed, "virtual" file system of Alfresco. For that reason it should not be possible to trigger remote code execution on any well known server binaries. Furthermore, the implementation will treat any file content as generic blobs, and not load any of them as executable components within the Java runtime.</P><P></P><P><A __default_attr="87041" __jive_macro_name="user" _jive_internal="true" data-id="87041" data-objecttype="3" data-type="person" href="https://community.alfresco.com/people/fcorti" rel="nofollow noopener noreferrer"></A>‌: Maybe you could check with Engineering and provide an "official" response?</P></BODY></HTML> Thu, 01 Jun 2017 14:27:46 GMT afaust 2017-06-01T14:27:46Z Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ? https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30135#M12815 Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ?Apparently its a 7 year old Samba vulnerability:http://systemini.net/index.php/community/files/33-gc/5078-samba-users-urged-to-patch-7-year-old-remote-code-execution-fl…&nbsp;Is there a patch to fix this for Alfresco Community Edition? Thu, 01 Jun 2017 09:32:53 GMT https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30135#M12815 robertscally 2017-06-01T09:32:53Z Re: Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ? https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30136#M12816 <HTML><HEAD></HEAD><BODY><P>Alfresco has nothing to do with the Samba product line - except that it includes a Java-based implementation of the SMB protocol that is completely separate / distinct from the implementation found in Samba.</P><P>I am reluctant to give any answer that might be taken as conclusive. For one thing, Alfresco SMB support works very different from actual file server SMB. As far as I know, the implementation will not be able to touch any files on the operating system layer, since the SMB support is backed by the logical database-backed, "virtual" file system of Alfresco. For that reason it should not be possible to trigger remote code execution on any well known server binaries. Furthermore, the implementation will treat any file content as generic blobs, and not load any of them as executable components within the Java runtime.</P><P></P><P><A __default_attr="87041" __jive_macro_name="user" _jive_internal="true" data-id="87041" data-objecttype="3" data-type="person" href="https://community.alfresco.com/people/fcorti" rel="nofollow noopener noreferrer"></A>‌: Maybe you could check with Engineering and provide an "official" response?</P></BODY></HTML> Thu, 01 Jun 2017 14:27:46 GMT https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30136#M12816 afaust 2017-06-01T14:27:46Z Re: Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ? https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30137#M12817 <HTML><HEAD></HEAD><BODY><P>Ok thanks for that explanation Axel. I was unsure whether or not Alfresco used its own version of Samba or if it used the Samba installed on the server.</P><P></P><P>Would be great to have the "official" response also.</P></BODY></HTML> Thu, 01 Jun 2017 16:12:01 GMT https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30137#M12817 robertscally 2017-06-01T16:12:01Z Re: Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ? https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30138#M12818 <HTML><HEAD></HEAD><BODY><P><B>Axel Faust</B>‌ gave an excellent explanation. We won't have the same vulnerability exposure as the Samba project.</P></BODY></HTML> Mon, 05 Jun 2017 10:53:50 GMT https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30138#M12818 resplin 2017-06-05T10:53:50Z Re: Is Alfresco vulnerable to Samba vulnerability (CVE-2017-7494) ? https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30139#M12819 <HTML><HEAD></HEAD><BODY><P>That is good to hear Richard. Thanks.</P></BODY></HTML> Tue, 06 Jun 2017 15:45:39 GMT https://connect.hyland.com/t5/alfresco-forum/is-alfresco-vulnerable-to-samba-vulnerability-cve-2017-7494/m-p/30139#M12819 robertscally 2017-06-06T15:45:39Z