CVE-2007-2446 Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (net...
HighCVSS 10.0
EPSS 77.7%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.0.0 | No fix listed |
| samba | = 3.0.1 | No fix listed |
| samba | = 3.0.2 | No fix listed |
| samba | = 3.0.2a | No fix listed |
| samba | = 3.0.10 | No fix listed |
| samba | = 3.0.11 | No fix listed |
| samba | = 3.0.12 | No fix listed |
| samba | = 3.0.13 | No fix listed |
| samba | = 3.0.14 | No fix listed |
| samba | = 3.0.14a | No fix listed |
| samba | = 3.0.15 | No fix listed |
| samba | = 3.0.16 | No fix listed |
| samba | = 3.0.17 | No fix listed |
| samba | = 3.0.18 | No fix listed |
| samba | = 3.0.19 | No fix listed |
| samba | = 3.0.20 | No fix listed |
| samba | = 3.0.20a | No fix listed |
| samba | = 3.0.20b | No fix listed |
| samba | = 3.0.21 | No fix listed |
| samba | = 3.0.21a | No fix listed |
| samba | = 3.0.21b | No fix listed |
| samba | = 3.0.21c | No fix listed |
| samba | = 3.0.22 | No fix listed |
| samba | = 3.0.23 | No fix listed |
| samba | = 3.0.23a | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.0.23b | No fix listed |
| samba | = 3.0.23c | No fix listed |
| samba | = 3.0.23d | No fix listed |
| samba | = 3.0.24 | No fix listed |
| samba | = 3.0.25-pre1 | No fix listed |
| samba | = 3.0.25-pre2 | No fix listed |
| samba | = 3.0.25-rc1 | No fix listed |
| samba | = 3.0.25-rc2 | No fix listed |
| samba | = 3.0.25-rc3 | No fix listed |
| debian/samba(Debian:12) | < 3.0.25-1 | 3.0.25-1 |
| debian/samba(Debian:13) | < 3.0.25-1 | 3.0.25-1 |
| debian/samba(Debian:14) | < 3.0.25-1 | 3.0.25-1 |
References
- Debian Security Tracker CVE-2007-2446 vendor-advisory
- docs.info.apple.com
- HPSBUX02218 vendor-advisory
- HPSBTU02218 vendor-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
- SUSE-SA:2007:031 vendor-advisory
- 34699 vdb-entry
- 34731 vdb-entry
- 34733 vdb-entry
- 25232 third-party-advisory vendor-advisory
- 25241 third-party-advisory vendor-advisory
- 25246 third-party-advisory vendor-advisory
- 25251 third-party-advisory vendor-advisory
- 25255 third-party-advisory vendor-advisory
- 25256 third-party-advisory vendor-advisory
- 25257 third-party-advisory vendor-advisory
- 25259 third-party-advisory vendor-advisory
- 25270 third-party-advisory vendor-advisory
- 25289 third-party-advisory
- 25391 third-party-advisory
- 25567 third-party-advisory
- 25675 third-party-advisory
- 25772 third-party-advisory
- 26235 third-party-advisory
- 26909 third-party-advisory
- 27706 third-party-advisory
- 28292 third-party-advisory
- GLSA-200705-15 vendor-advisory
- 2702 third-party-advisory
- SSA:2007-134-01 vendor-advisory
- 102964 vendor-advisory
- 200588 vendor-advisory
- DSA-1291 vendor-advisory
- VU#773720 third-party-advisory us-government-resource
- MDKSA-2007:104 vendor-advisory
- OpenPKG-SA-2007.012 vendor-advisory
- 34732 vdb-entry
- RHSA-2007:0354 vendor-advisory
- www.samba.org patch vendor-advisory
- 20070513 [SAMBA-SECURITY] CVE-2007-2446: Multiple Heap Overflows Allow Remote Code Execution mailing-list
- 20070515 FLEA-2007-0017-1: samba mailing-list
- 20070515 ZDI-07-032: Samba sec_io_acl Heap Overflow Vulnerability mailing-list
- 20070515 ZDI-07-031: Samba smb_io_notify_option_type_data Heap Overflow Vulnerability mailing-list
- 20070515 ZDI-07-029: Samba lsa_io_privilege_set Heap Overflow Vulnerability mailing-list
- 20070515 ZDI-07-030: Samba netdfs_io_dfs_EnumInfo_d Heap Overflow Vulnerability mailing-list
- 20070515 ZDI-07-033: Samba lsa_io_trans_names Heap Overflow Vulnerability mailing-list
- 23973 vdb-entry
- 24195 vdb-entry
- 24196 vdb-entry
- 24197 vdb-entry
- 24198 vdb-entry
- 25159 vdb-entry
- 1018050 vdb-entry
- 2007-0017 vendor-advisory
- USN-460-1 vendor-advisory
- ADV-2007-1805 vdb-entry
- ADV-2007-2079 vdb-entry
- ADV-2007-2210 vdb-entry
- ADV-2007-2281 vdb-entry
- ADV-2007-2732 vdb-entry
- ADV-2007-3229 vdb-entry
- ADV-2008-0050 vdb-entry
- www.xerox.com
- www.zerodayinitiative.com
- www.zerodayinitiative.com
- www.zerodayinitiative.com
- www.zerodayinitiative.com
- www.zerodayinitiative.com
- samba-lsaioprivilegeset-bo(34309) vdb-entry
- samba-netdfsiodfsenuminfod-bo(34311) vdb-entry
- samba-smbionotifyoptiontypedata-bo(34312) vdb-entry
- samba-secioacl-bo(34314) vdb-entry
- samba-lsaiotransnames-bo(34316) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:11415 signature vdb-entry