CVE-2007-2447
NoneCVSS
—
EPSS
49.8%
Published
May 14, 2007
CISA due date
—
The record
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | samba | 0 | 3.0.25-1 |
| Debian:11 | samba | 0 | 3.0.25-1 |
| Debian:12 | samba | 0 | 3.0.25-1 |
| Debian:13 | samba | 0 | 3.0.25-1 |
| Debian:3.1 | samba | 0 | 3.0.14a-3sarge6 |
| Debian:4.0 | samba | 0 | 3.0.24-6etch2 |
| Debian:5.0 | samba | 0 | 3.0.24-6+lenny3 |
| Red Hat:enterprise_linux:2.1::as | samba | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::as | samba-client | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::as | samba-common | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::as | samba-swat | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::aw | samba | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::aw | samba-client | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::aw | samba-common | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::aw | samba-swat | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::es | samba | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::es | samba-client | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::es | samba-common | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::es | samba-swat | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::ws | samba | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::ws | samba-client | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::ws | samba-common | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:2.1::ws | samba-swat | 0 | 0:2.2.12-1.21as.6 |
| Red Hat:enterprise_linux:3::as | samba | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::as | samba-client | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::as | samba-common | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::as | samba-debuginfo | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::as | samba-swat | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba-client | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba-common | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba-debuginfo | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::desktop | samba-swat | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba-client | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba-common | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba-debuginfo | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::es | samba-swat | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba-client | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba-common | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba-debuginfo | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:3::ws | samba-swat | 0 | 0:3.0.9-1.3E.13.2 |
| Red Hat:enterprise_linux:4::as | samba | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::as | samba-client | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::as | samba-common | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::as | samba-debuginfo | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::as | samba-swat | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba-client | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba-common | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba-debuginfo | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::desktop | samba-swat | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba-client | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba-common | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba-debuginfo | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::es | samba-swat | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba-client | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba-common | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba-debuginfo | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:4::ws | samba-swat | 0 | 0:3.0.10-1.4E.12.2 |
| Red Hat:enterprise_linux:5::client | samba | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::client | samba-client | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::client | samba-common | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::client | samba-debuginfo | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::client | samba-swat | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba-client | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba-common | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba-debuginfo | 0 | 0:3.0.23c-2.el5.2.0.2 |
| Red Hat:enterprise_linux:5::server | samba-swat | 0 | 0:3.0.23c-2.el5.2.0.2 |
| openSUSE:Tumbleweed | cifs-utils | 0 | 6.13-1.3 |
| openSUSE:Tumbleweed | samba | 0 | 4.14.6+git.182.2205d5224e3-1.1 |
Related vulnerabilities
- CVE-2014-0178 Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain… Also affects samba
- CVE-2013-4124 Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x… Also affects samba
- CVE-2011-2522 Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web… Also affects samba
- CVE-2010-2063 Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in… Also affects samba
- CVE-2010-0926 The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x… Also affects samba
- CVE-2008-1105 Heap-based buffer overflow in the receive_smb_raw function in util/sock.c in Samba 3.0.0… Also affects samba
- CVE-2007-6015 Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through… Also affects samba
- CVE-2007-5398 Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c… Also affects samba