CVE-2007-2447 The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the...
MediumCVSS 6.0
EPSS 49.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.0.0 | No fix listed |
| samba | = 3.0.1 | No fix listed |
| samba | = 3.0.2 | No fix listed |
| samba | = 3.0.2a | No fix listed |
| samba | = 3.0.3 | No fix listed |
| samba | = 3.0.4 | No fix listed |
| samba | = 3.0.4-rc1 | No fix listed |
| samba | = 3.0.5 | No fix listed |
| samba | = 3.0.6 | No fix listed |
| samba | = 3.0.7 | No fix listed |
| samba | = 3.0.8 | No fix listed |
| samba | = 3.0.9 | No fix listed |
| samba | = 3.0.10 | No fix listed |
| samba | = 3.0.11 | No fix listed |
| samba | = 3.0.12 | No fix listed |
| samba | = 3.0.13 | No fix listed |
| samba | = 3.0.14 | No fix listed |
| samba | = 3.0.14a | No fix listed |
| samba | = 3.0.15 | No fix listed |
| samba | = 3.0.16 | No fix listed |
| samba | = 3.0.17 | No fix listed |
| samba | = 3.0.18 | No fix listed |
| samba | = 3.0.19 | No fix listed |
| samba | = 3.0.20 | No fix listed |
| samba | = 3.0.20a | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| samba | = 3.0.20b | No fix listed |
| samba | = 3.0.21 | No fix listed |
| samba | = 3.0.21a | No fix listed |
| samba | = 3.0.21b | No fix listed |
| samba | = 3.0.21c | No fix listed |
| samba | = 3.0.22 | No fix listed |
| samba | = 3.0.23 | No fix listed |
| samba | = 3.0.23a | No fix listed |
| samba | = 3.0.23b | No fix listed |
| samba | = 3.0.23c | No fix listed |
| samba | = 3.0.23d | No fix listed |
| samba | = 3.0.24 | No fix listed |
| samba | = 3.0.25-pre1 | No fix listed |
| samba | = 3.0.25-pre2 | No fix listed |
| samba | = 3.0.25-rc1 | No fix listed |
| samba | = 3.0.25-rc2 | No fix listed |
| samba | = 3.0.25-rc3 | No fix listed |
| debian/samba(Debian:12) | < 3.0.25-1 | 3.0.25-1 |
| debian/samba(Debian:13) | < 3.0.25-1 | 3.0.25-1 |
| debian/samba(Debian:14) | < 3.0.25-1 | 3.0.25-1 |
References
- Debian Security Tracker CVE-2007-2447 vendor-advisory
- docs.info.apple.com
- HPSBUX02218 vendor-advisory
- HPSBTU02218 vendor-advisory
- 20070514 Samba SAMR Change Password Remote Command Injection Vulnerability third-party-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
- SUSE-SA:2007:031 vendor-advisory
- 25232 third-party-advisory vendor-advisory
- 25241 third-party-advisory vendor-advisory
- 25246 third-party-advisory vendor-advisory
- 25251 third-party-advisory vendor-advisory
- 25255 third-party-advisory vendor-advisory
- 25256 third-party-advisory vendor-advisory
- 25257 third-party-advisory vendor-advisory
- 25259 third-party-advisory vendor-advisory
- 25270 third-party-advisory vendor-advisory
- 25289 third-party-advisory
- 25567 third-party-advisory
- 25675 third-party-advisory
- 25772 third-party-advisory
- 26083 third-party-advisory
- 26235 third-party-advisory
- 26909 third-party-advisory
- 27706 third-party-advisory
- 28292 third-party-advisory
- GLSA-200705-15 vendor-advisory
- 2700 third-party-advisory
- SSA:2007-134-01 vendor-advisory
- 102964 vendor-advisory
- 200588 vendor-advisory
- DSA-1291 vendor-advisory
- VU#268336 third-party-advisory us-government-resource
- MDKSA-2007:104 vendor-advisory
- SUSE-SR:2007:014 vendor-advisory
- OpenPKG-SA-2007.012 vendor-advisory
- 34700 vdb-entry
- RHSA-2007:0354 vendor-advisory
- www.samba.org patch vendor-advisory
- 20070513 [SAMBA-SECURITY] CVE-2007-2447: Remote Command Injection Vulnerability mailing-list
- 20070515 FLEA-2007-0017-1: samba mailing-list
- 23972 vdb-entry
- 25159 vdb-entry
- 1018051 vdb-entry
- 2007-0017 vendor-advisory
- USN-460-1 vendor-advisory
- ADV-2007-1805 vdb-entry
- ADV-2007-2079 vdb-entry
- ADV-2007-2210 vdb-entry
- ADV-2007-2281 vdb-entry
- ADV-2007-2732 vdb-entry
- ADV-2007-3229 vdb-entry
- ADV-2008-0050 vdb-entry
- www.xerox.com
- issues.rpath.com
- oval:org.mitre.oval:def:10062 signature vdb-entry
- www.openwall.com