National Vulnerability Database (NVD) National Vulnerability Database (CVE-2007-2446)

National Cyber Awareness System

Vulnerability Summary for CVE-2007-2446

Original release date:05/14/2007

Last revised:10/31/2012

Source: US-CERT/NIST

Overview

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).

Impact

CVSS Severity (version 2.0):

CVSS v2 Base Score:10.0 (HIGH) (AV:N/AC:L/Au:N/C:C/I:C/A:C) (legend)

Impact Subscore: 10.0

Exploitability Subscore: 10.0

CVSS Version 2 Metrics:

Access Vector: Network exploitable

Access Complexity: Low

Authentication: Not required to exploit

Impact Type:Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#773720

Name: VU#773720

Hyperlink:http://www.kb.cert.org/vuls/id/773720

External Source: BUGTRAQ

Name: 20070513 [SAMBA-SECURITY] CVE-2007-2446: Multiple Heap Overflows Allow Remote Code Execution

Type: Patch Information

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/468542/100/0/threaded

External Source: CONFIRM

Name: http://www.samba.org/samba/security/CVE-2007-2446.html

Type: Advisory; Patch Information

Hyperlink:http://www.samba.org/samba/security/CVE-2007-2446.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1366

Hyperlink:https://issues.rpath.com/browse/RPL-1366

External Source: XF

Name: samba-lsaiotransnames-bo(34316)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34316

External Source: XF

Name: samba-secioacl-bo(34314)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34314

External Source: XF

Name: samba-smbionotifyoptiontypedata-bo(34312)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34312

External Source: XF

Name: samba-netdfsiodfsenuminfod-bo(34311)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34311

External Source: XF

Name: samba-lsaioprivilegeset-bo(34309)

Hyperlink:http://xforce.iss.net/xforce/xfdb/34309

External Source: MISC

Name: http://www.zerodayinitiative.com/advisories/ZDI-07-033.html

Hyperlink:http://www.zerodayinitiative.com/advisories/ZDI-07-033.html

External Source: MISC

Name: http://www.zerodayinitiative.com/advisories/ZDI-07-032.html

Hyperlink:http://www.zerodayinitiative.com/advisories/ZDI-07-032.html

External Source: MISC

Name: http://www.zerodayinitiative.com/advisories/ZDI-07-031.html

Hyperlink:http://www.zerodayinitiative.com/advisories/ZDI-07-031.html

External Source: MISC

Name: http://www.zerodayinitiative.com/advisories/ZDI-07-030.html

Hyperlink:http://www.zerodayinitiative.com/advisories/ZDI-07-030.html

External Source: MISC

Name: http://www.zerodayinitiative.com/advisories/ZDI-07-029.html

Hyperlink:http://www.zerodayinitiative.com/advisories/ZDI-07-029.html

External Source: VUPEN

Name: ADV-2008-0050

Hyperlink:http://www.vupen.com/english/advisories/2008/0050

External Source: VUPEN

Name: ADV-2007-3229

Hyperlink:http://www.vupen.com/english/advisories/2007/3229

External Source: VUPEN

Name: ADV-2007-2732

Hyperlink:http://www.vupen.com/english/advisories/2007/2732

External Source: VUPEN

Name: ADV-2007-2281

Hyperlink:http://www.vupen.com/english/advisories/2007/2281

External Source: VUPEN

Name: ADV-2007-2210

Hyperlink:http://www.vupen.com/english/advisories/2007/2210

External Source: VUPEN

Name: ADV-2007-2079

Hyperlink:http://www.vupen.com/english/advisories/2007/2079

External Source: VUPEN

Name: ADV-2007-1805

Hyperlink:http://www.vupen.com/english/advisories/2007/1805

External Source: UBUNTU

Name: USN-460-1

Hyperlink:http://www.ubuntu.com/usn/usn-460-1

External Source: TRUSTIX

Name: 2007-0017

Hyperlink:http://www.trustix.org/errata/2007/0017/

External Source: SECTRACK

Name: 1018050

Hyperlink:http://www.securitytracker.com/id?1018050

External Source: BID

Name: 24198

Hyperlink:http://www.securityfocus.com/bid/24198

External Source: BID

Name: 24197

Hyperlink:http://www.securityfocus.com/bid/24197

External Source: BID

Name: 24196

Hyperlink:http://www.securityfocus.com/bid/24196

External Source: BID

Name: 24195

Hyperlink:http://www.securityfocus.com/bid/24195

External Source: BID

Name: 23973

Hyperlink:http://www.securityfocus.com/bid/23973

External Source: BUGTRAQ

Name: 20070515 ZDI-07-033: Samba lsa_io_trans_names Heap Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/468680/100/0/threaded

External Source: BUGTRAQ

Name: 20070515 ZDI-07-030: Samba netdfs_io_dfs_EnumInfo_d Heap Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/468675/100/0/threaded

External Source: BUGTRAQ

Name: 20070515 ZDI-07-029: Samba lsa_io_privilege_set Heap Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/468674/100/0/threaded

External Source: BUGTRAQ

Name: 20070515 ZDI-07-031: Samba smb_io_notify_option_type_data Heap Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/468673/100/0/threaded

External Source: BUGTRAQ

Name: 20070515 ZDI-07-032: Samba sec_io_acl Heap Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/468672/100/0/threaded

External Source: BUGTRAQ

Name: 20070515 FLEA-2007-0017-1: samba

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/468670/100/0/threaded

External Source: REDHAT

Name: RHSA-2007:0354

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0354.html

External Source: OPENPKG

Name: OpenPKG-SA-2007.012

Hyperlink:http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html

External Source: MANDRIVA

Name: MDKSA-2007:104

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:104

External Source: DEBIAN

Name: DSA-1291

Hyperlink:http://www.debian.org/security/2007/dsa-1291

External Source: SUNALERT

Name: 102964

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1

External Source: SLACKWARE

Name: SSA:2007-134-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906

External Source: GENTOO

Name: GLSA-200705-15

Hyperlink:http://security.gentoo.org/glsa/glsa-200705-15.xml

External Source: SECUNIA

Name: 25391

Hyperlink:http://secunia.com/advisories/25391/

External Source: SECUNIA

Name: 25270

Type: Advisory

Hyperlink:http://secunia.com/advisories/25270

External Source: SECUNIA

Name: 25259

Type: Advisory

Hyperlink:http://secunia.com/advisories/25259

External Source: SECUNIA

Name: 25257

Type: Advisory

Hyperlink:http://secunia.com/advisories/25257

External Source: SECUNIA

Name: 25256

Type: Advisory

Hyperlink:http://secunia.com/advisories/25256

External Source: SECUNIA

Name: 25255

Type: Advisory

Hyperlink:http://secunia.com/advisories/25255

External Source: SECUNIA

Name: 25251

Type: Advisory

Hyperlink:http://secunia.com/advisories/25251

External Source: SECUNIA

Name: 25246

Type: Advisory

Hyperlink:http://secunia.com/advisories/25246

External Source: SECUNIA

Name: 25241

Type: Advisory

Hyperlink:http://secunia.com/advisories/25241

External Source: SECUNIA

Name: 25232

Type: Advisory

Hyperlink:http://secunia.com/advisories/25232

External Source: OVAL

Name: oval:org.mitre.oval:def:11415

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11415

External Source: OSVDB

Name: 34733

Hyperlink:http://osvdb.org/34733

External Source: OSVDB

Name: 34731

Hyperlink:http://osvdb.org/34731

External Source: OSVDB

Name: 34699

Hyperlink:http://osvdb.org/34699

External Source: SUSE

Name: SUSE-SA:2007:031

Hyperlink:http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html

External Source: FULLDISC

Name: 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player

Hyperlink:http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html

External Source: APPLE

Name: APPLE-SA-2007-07-31

Hyperlink:http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html

External Source: HP

Name: HPSBTU02218

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980

External Source: HP

Name: SSRT071424

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768

External Source: HP

Name: SSRT071424