vulnwire
10.0crit

CVE-2007-2446in critical feed9 exploits

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrar…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
77.7%
percentile 100%
Public exploits
9
Metasploit · Exploit-DB

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).

Exploit prediction (EPSS)

77.66% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

CVSS scores

Assigned byVersionScoreVector
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • security.gentoo.org /glsa/glsa-200705-15.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityfocus.com /archive/1/468672/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/25289 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.grok.org.uk /pipermail/full-disclosure/2007-September/065902.html · mailing-list, x_refsource_FULLDISC, x_transferred
  • securityfocus.com /archive/1/468673/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /archive/1/468674/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • samba.org /samba/security/CVE-2007-2446.html · x_refsource_CONFIRM, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/34316 · vdb-entry, x_refsource_XF, x_transferred
  • xerox.com /downloads/usa/en/c/cert_XRX08_001.pdf · x_refsource_CONFIRM, x_transferred
  • vupen.com /english/advisories/2007/2732 · vdb-entry, x_refsource_VUPEN, x_transferred
  • vupen.com /english/advisories/2007/1805 · vdb-entry, x_refsource_VUPEN, x_transferred
  • vupen.com /english/advisories/2007/3229 · vdb-entry, x_refsource_VUPEN, x_transferred
  • secunia.com /advisories/25772 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768 · vendor-advisory, x_refsource_HP, x_transferred
  • openpkg.com /security/advisories/OpenPKG-SA-2007.012.html · vendor-advisory, x_refsource_OPENPKG, x_transferred
  • secunia.com /advisories/25257 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/25391/ · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/24198 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /archive/1/468675/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • lists.suse.com /archive/suse-security-announce/2007-May/0006.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • secunia.com /advisories/25270 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/468670/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • lists.apple.com /archives/security-announce//2007/Jul/msg00004.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/34314 · vdb-entry, x_refsource_XF, x_transferred
  • vupen.com /english/advisories/2007/2281 · vdb-entry, x_refsource_VUPEN, x_transferred
  • zerodayinitiative.com /advisories/ZDI-07-033.html · x_refsource_MISC, x_transferred
  • vupen.com /english/advisories/2007/2210 · vdb-entry, x_refsource_VUPEN, x_transferred
  • h20000.www2.hp.com /bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980 · vendor-advisory, x_refsource_HP, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/34311 · vdb-entry, x_refsource_XF, x_transferred
  • trustix.org /errata/2007/0017/ · vendor-advisory, x_refsource_TRUSTIX, x_transferred
  • ubuntu.com /usn/usn-460-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/34312 · vdb-entry, x_refsource_XF, x_transferred
  • securityreason.com /securityalert/2702 · third-party-advisory, x_refsource_SREASON, x_transferred
  • secunia.com /advisories/25567 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /34731 · vdb-entry, x_refsource_OSVDB, x_transferred
  • zerodayinitiative.com /advisories/ZDI-07-031.html · x_refsource_MISC, x_transferred
  • osvdb.org /34699 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/25241 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/28292 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2007:104 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • docs.info.apple.com /article.html?artnum=306172
  • osvdb.org /34733
  • secunia.com /advisories/25232 · Vendor Advisory
  • secunia.com /advisories/25246 · Vendor Advisory
  • secunia.com /advisories/25251 · Vendor Advisory
  • secunia.com /advisories/25255 · Vendor Advisory
  • secunia.com /advisories/25256 · Vendor Advisory
  • secunia.com /advisories/25259 · Vendor Advisory
  • secunia.com /advisories/25675
  • secunia.com /advisories/26235
  • secunia.com /advisories/26909
  • secunia.com /advisories/27706
  • slackware.com /security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906
  • sunsolve.sun.com /search/document.do?assetkey=1-26-102964-1
  • sunsolve.sun.com /search/document.do?assetkey=1-66-200588-1
  • debian.org /security/2007/dsa-1291
  • kb.cert.org /vuls/id/773720 · US Government Resource
  • osvdb.org /34732
  • redhat.com /support/errata/RHSA-2007-0354.html · Vendor Advisory
  • securityfocus.com /archive/1/468542/100/0/threaded

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.