CVE-2007-2446: samba

Modified

AliasesDEBIAN-CVE-2007-2446

Published 14-05-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-2446 is a high (CVSS 10.0) vulnerability in samba. EPSS estimates a 77.66% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 9 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 14-07-2010)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

77.66%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits9exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 5 · Related 2

DSA-1291-2 DTSA-41-1 OPENSUSE-SU-2024:10683-1 OPENSUSE-SU-2024:11365-1 RHSA-2007:0354

Timeline

14-05-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

77.66%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 77.66% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

9 found

exploit-databaseremotelinuxVerified
Samba 3.0.21 < 3.0.24 - LSA trans names Heap Overflow (Metasploit)
Maturity: weaponized
exploit-databaseremotelinuxVerified
Samba 3.0.24 (Linux) - 'lsa_io_trans_names' Heap Overflow (Metasploit)
Maturity: weaponized
exploit-databaseremoteosxVerified
Samba 3.0.10 (OSX) - 'lsa_io_trans_names' Heap Overflow (Metasploit)
Maturity: weaponized

Show all 9 exploits

exploit-databaseremotesolarisVerified
Samba 3.0.24 (Solaris) - 'lsa_io_trans_names' Heap Overflow (Metasploit)
Maturity: weaponized
MetasploitremoteUnverified
Samba lsa_io_privilege_set Heap Overflow
auxiliary/dos/samba/lsa_addprivs_heap
Maturity: poc
MetasploitremoteUnverified
Samba lsa_io_trans_names Heap Overflow
auxiliary/dos/samba/lsa_transnames_heap
Maturity: poc
MetasploitremoteVerified
Samba lsa_io_trans_names Heap Overflow
exploit/linux/samba/lsa_transnames_heap
Maturity: weaponized
MetasploitremoteUnverified
Samba lsa_io_trans_names Heap Overflow
exploit/osx/samba/lsa_transnames_heap
Maturity: poc
MetasploitremoteUnverified
Samba lsa_io_trans_names Heap Overflow
exploit/solaris/samba/lsa_transnames_heap
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product

samba< 3.0.25-1

Samba1 product

sambaEOL3.0.0 | 3.0.1 | 3.0.2 | 3.0.2a | 3.0.10 | 3.0.11 | 3.0.12 | 3.0.13 | 3.0.14 | 3.0.14a | 3.0.15 | 3.0.16 | 3.0.17 | 3.0.18 | 3.0.19 | 3.0.20 | 3.0.20a | 3.0.20b | 3.0.21 | 3.0.21a | 3.0.21b | 3.0.21c | 3.0.22 | 3.0.23 | 3.0.23a | 3.0.23b | 3.0.23c | 3.0.23d | 3.0.24 | 3.0.25:pre1 | 3.0.25:pre2 | 3.0.25:rc1 | 3.0.25:rc2 | 3.0.25:rc3

2 vendors · 2 products

References

76 links

security.gentoo.org/glsa/glsa-200705-15.xmlVendor AdvisoryX Refsource GENTOO
www.securityfocus.com/archive/1/468672/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/25289Third Party AdvisoryX Refsource SECUNIA
lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.htmlMailing ListX Refsource FULLDISC
www.securityfocus.com/archive/1/468673/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/archive/1/468674/100/0/threadedMailing ListX Refsource BUGTRAQ
www.samba.org/samba/security/CVE-2007-2446.htmlX Refsource CONFIRMPatchVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/34316VDB EntryX Refsource XF
www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdfX Refsource CONFIRM
www.vupen.com/english/advisories/2007/2732VDB EntryX Refsource VUPEN

Show all 76 references

www.vupen.com/english/advisories/2007/1805VDB EntryX Refsource VUPEN
www.vupen.com/english/advisories/2007/3229VDB EntryX Refsource VUPEN
secunia.com/advisories/25772Third Party AdvisoryX Refsource SECUNIA
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768Vendor AdvisoryX Refsource HP
www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.htmlVendor AdvisoryX Refsource OPENPKG
secunia.com/advisories/25257Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/25391/Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/24198VDB EntryX Refsource BID
www.securityfocus.com/archive/1/468675/100/0/threadedMailing ListX Refsource BUGTRAQ
lists.suse.com/archive/suse-security-announce/2007-May/0006.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/25270Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/468670/100/0/threadedMailing ListX Refsource BUGTRAQ
lists.apple.com/archives/security-announce//2007/Jul/msg00004.htmlVendor AdvisoryX Refsource APPLE
exchange.xforce.ibmcloud.com/vulnerabilities/34314VDB EntryX Refsource XF
www.vupen.com/english/advisories/2007/2281VDB EntryX Refsource VUPEN
www.zerodayinitiative.com/advisories/ZDI-07-033.htmlX Refsource MISC
www.vupen.com/english/advisories/2007/2210VDB EntryX Refsource VUPEN
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980Vendor AdvisoryX Refsource HP
exchange.xforce.ibmcloud.com/vulnerabilities/34311VDB EntryX Refsource XF
www.trustix.org/errata/2007/0017/Vendor AdvisoryX Refsource TRUSTIX
www.ubuntu.com/usn/usn-460-1Vendor AdvisoryX Refsource UBUNTU
exchange.xforce.ibmcloud.com/vulnerabilities/34312VDB EntryX Refsource XF
securityreason.com/securityalert/2702Third Party AdvisoryX Refsource SREASON
secunia.com/advisories/25567Third Party AdvisoryX Refsource SECUNIA
osvdb.org/34731VDB EntryX Refsource OSVDB
www.zerodayinitiative.com/advisories/ZDI-07-031.htmlX Refsource MISC
osvdb.org/34699VDB EntryX Refsource OSVDB
secunia.com/advisories/25241Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/28292Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:104Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/25256Third Party AdvisoryX Refsource SECUNIAVendor Advisory
issues.rpath.com/browse/RPL-1366X Refsource CONFIRM
secunia.com/advisories/25259Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/34309VDB EntryX Refsource XF
slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906Vendor AdvisoryX Refsource SLACKWARE
www.osvdb.org/34732VDB EntryX Refsource OSVDB
sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1Vendor AdvisoryX Refsource SUNALERT
www.securityfocus.com/archive/1/468542/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securitytracker.com/id?1018050VDB EntryX Refsource SECTRACK
www.securityfocus.com/bid/23973VDB EntryX Refsource BID
www.zerodayinitiative.com/advisories/ZDI-07-030.htmlX Refsource MISC
secunia.com/advisories/26909Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/0050VDB EntryX Refsource VUPEN
secunia.com/advisories/27706Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2007/dsa-1291Vendor AdvisoryX Refsource DEBIAN
www.kb.cert.org/vuls/id/773720Third Party AdvisoryX Refsource CERT VNUS Government Resource
docs.info.apple.com/article.html?artnum=306172X Refsource CONFIRM
secunia.com/advisories/25232Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/25251Third Party AdvisoryX Refsource SECUNIAVendor Advisory
sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1Vendor AdvisoryX Refsource SUNALERT
secunia.com/advisories/25246Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/468680/100/0/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/bid/24197VDB EntryX Refsource BID
osvdb.org/34733VDB EntryX Refsource OSVDB
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415VDB EntrySignatureX Refsource OVAL
www.securityfocus.com/bid/25159VDB EntryX Refsource BID
www.zerodayinitiative.com/advisories/ZDI-07-032.htmlX Refsource MISC
secunia.com/advisories/25255Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/24196VDB EntryX Refsource BID
www.redhat.com/support/errata/RHSA-2007-0354.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/bid/24195VDB EntryX Refsource BID
www.zerodayinitiative.com/advisories/ZDI-07-029.htmlX Refsource MISC
secunia.com/advisories/26235Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25675Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/2079VDB EntryX Refsource VUPEN
security-tracker.debian.org/tracker/CVE-2007-2446Advisory