{"schemaVersion":3,"id":"CVE-2007-1748","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Server 2003 SP 1, and Server 2003 SP 2 allows remote attackers to execute arbitrary code via a long zone name containing character constants represented by escape sequences.","dates":{"published":"2007-04-13T18:00:00.000Z","modified":"2024-08-07T13:06:26.357Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.77664,"percentile":0.99566,"severity":"critical","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.77664},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.77664,"percentile":0.99566}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.77664,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.77664,"percentile":0.99566}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"16366","name":"Microsoft DNS RPC Service - 'extractQuotedChar()' Remote Overflow 'SMB' (MS07-029) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16366","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/16366.rb","codes":["CVE-2007-1748","OSVDB-34100","MS07-029"]},"metasploit":null},{"id":"16748","name":"Microsoft DNS RPC Service - 'extractQuotedChar()' TCP Overflow (MS07-029) (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/16748","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/16748.rb","codes":["CVE-2007-1748","OSVDB-34100","MS07-029"]},"metasploit":null},{"id":"3740","name":"Microsoft Windows - DNS DnssrvQuery Remote Stack Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3740","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/3740.c","codes":["OSVDB-34100","CVE-2007-1748"]},"metasploit":null},{"id":"3746","name":"Microsoft Windows - DNS RPC Remote Buffer Overflow (2)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3746","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/3746.txt","codes":["CVE-2007-1748"]},"metasploit":null},{"id":"3737","name":"Microsoft Windows Server 2000 SP4 - DNS RPC Remote Buffer Overflow","source":"exploit-database","url":"https://www.exploit-db.com/exploits/3737","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/3737.py","codes":["OSVDB-34100","CVE-2007-1748"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_DCERPC_MS07_029_MSDNS_ZONENAME","name":"MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/dcerpc/ms07_029_msdns_zonename.rb","maturity":"weaponized","reliabilityScore":0.8333333333333334,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/dcerpc/ms07_029_msdns_zonename","rank":"500","rankName":"great","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}},{"id":"MSF_EXPLOIT_WINDOWS_SMB_MS07_029_MSDNS_ZONENAME","name":"MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/smb/ms07_029_msdns_zonename.rb","maturity":"poc","reliabilityScore":0,"verified":false,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/smb/ms07_029_msdns_zonename","rank":"0","rankName":"manual","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":7,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"microsoft","product":"windows_2003_server","name":"windows 2003 server","label":"windows_2003_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"sp1","noFixRecorded":false,"fixedIn":null},{"text":"sp2","noFixRecorded":false,"fixedIn":null}],"versionsText":"sp1 | sp2","eol":null,"hubHref":"/vendor/microsoft/windows_2003_server"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://secunia.com/advisories/24871","label":"secunia.com/advisories/24871","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/468871/100/200/threaded","label":"www.securityfocus.com/archive/1/468871/100/200/threaded","hostname":"www.securityfocus.com","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://www.securityfocus.com/archive/1/465863/100/100/threaded","label":"www.securityfocus.com/archive/1/465863/100/100/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.microsoft.com/technet/security/advisory/935964.mspx","label":"www.microsoft.com/technet/security/advisory/935964.mspx","hostname":"www.microsoft.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-128A.html","label":"www.us-cert.gov/cas/techalerts/TA07-128A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/23470","label":"www.securityfocus.com/bid/23470","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33629","label":"exchange.xforce.ibmcloud.com/vulnerabilities/33629","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://blogs.technet.com/msrc/archive/2007/04/12/microsoft-security-advisory-935964-posted.aspx","label":"blogs.technet.com/msrc/archive/2007/04/12/microsoft-security-advisory-935964-posted.aspx","hostname":"blogs.technet.com","tags":["X Refsource MISC"]},{"url":"http://www.securitytracker.com/id?1017910","label":"www.securitytracker.com/id?1017910","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://metasploit.com/svn/framework3/trunk/modules/exploits/windows/dcerpc/msdns_zonename.rb","label":"metasploit.com/svn/framework3/trunk/modules/exploits/windows/dcerpc/msdns_zonename.rb","hostname":"metasploit.com","tags":["X Refsource MISC"]},{"url":"http://www.vupen.com/english/advisories/2007/1366","label":"www.vupen.com/english/advisories/2007/1366","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1228","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1228","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA07-103A.html","label":"www.us-cert.gov/cas/techalerts/TA07-103A.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.kb.cert.org/vuls/id/555920","label":"www.kb.cert.org/vuls/id/555920","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-029","label":"docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-029","hostname":"docs.microsoft.com","tags":["Vendor Advisory","X Refsource MS"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2007-04-13T18:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T13:06:26.357Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T14:09:50.240Z","stale":false,"partial":false}}