CVE-2007-2446
NoneCVSS
—
EPSS
77.7%
Published
May 14, 2007
CISA due date
—
The record
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | samba | 0 | 3.0.25-1 |
| Debian:11 | samba | 0 | 3.0.25-1 |
| Debian:12 | samba | 0 | 3.0.25-1 |
| Debian:13 | samba | 0 | 3.0.25-1 |
| Debian:3.1 | samba | 0 | 3.0.14a-3sarge6 |
| Debian:4.0 | samba | 0 | 3.0.24-6etch2 |
| Debian:5.0 | samba | 0 | 3.0.24-6+lenny3 |
| Red Hat:enterprise_linux:2.1::as | samba | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::as | samba-client | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::as | samba-common | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::as | samba-swat | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::aw | samba | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::aw | samba-client | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::aw | samba-common | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::aw | samba-swat | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::es | samba | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::es | samba-client | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::es | samba-common | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::es | samba-swat | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::ws | samba | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::ws | samba-client | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::ws | samba-common | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::ws | samba-swat | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:3::as | samba | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::as | samba-client | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::as | samba-common | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::as | samba-debuginfo | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::as | samba-swat | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba-client | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba-common | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba-debuginfo | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba-swat | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba-client | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba-common | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba-debuginfo | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba-swat | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba-client | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba-common | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba-debuginfo | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba-swat | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:4::as | samba | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::as | samba-client | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::as | samba-common | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::as | samba-debuginfo | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::as | samba-swat | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba-client | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba-common | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba-debuginfo | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba-swat | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba-client | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba-common | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba-debuginfo | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba-swat | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba-client | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba-common | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba-debuginfo | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba-swat | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:5::client | samba | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::client | samba-client | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::client | samba-common | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::client | samba-debuginfo | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::client | samba-swat | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba-client | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba-common | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba-debuginfo | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba-swat | 0 | 0:3.0.23c-2.el5.2.0.2 |
| openSUSE:Tumbleweed | cifs-utils | 0 | 6.13-1.3 |
| openSUSE:Tumbleweed | samba | 0 | 4.14.6+git.182.2205d5224e3-1.1 |
Related vulnerabilities
- CVE-2014-0178 Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain… Also affects samba
- CVE-2013-4124 Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x… Also affects samba
- CVE-2011-2522 Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web… Also affects samba
- CVE-2010-2063 Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in… Also affects samba
- CVE-2010-0926 The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x… Also affects samba
- CVE-2008-1105 Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0… Also affects samba
- CVE-2007-6015 Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through… Also affects samba
- CVE-2007-5398 Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c… Also affects samba