CVE-2007-2446

Published: May 14, 2007Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).

Affected (34)

Products: Samba: Samba

Samba

1 product

Samba

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Samba Samba	Version 3.0.0
Samba Samba	Version 3.0.10
Samba Samba	Version 3.0.11
Samba Samba	Version 3.0.12
Samba Samba	Version 3.0.13
Samba Samba	Version 3.0.14
Samba Samba	Version 3.0.14a
Samba Samba	Version 3.0.15
Samba Samba	Version 3.0.16
Samba Samba	Version 3.0.17
Samba Samba	Version 3.0.18
Samba Samba	Version 3.0.19
Samba Samba	Version 3.0.1
Samba Samba	Version 3.0.20
Samba Samba	Version 3.0.20a
Samba Samba	Version 3.0.20b
Samba Samba	Version 3.0.21
Samba Samba	Version 3.0.21a
Samba Samba	Version 3.0.21b
Samba Samba	Version 3.0.21c
Samba Samba	Version 3.0.22
Samba Samba	Version 3.0.23
Samba Samba	Version 3.0.23a
Samba Samba	Version 3.0.23b
Samba Samba	Version 3.0.23c
Samba Samba	Version 3.0.23d
Samba Samba	Version 3.0.24
Samba Samba	Version 3.0.25 pre1
Samba Samba	Version 3.0.25 pre2
Samba Samba	Version 3.0.25 rc1
Samba Samba	Version 3.0.25 rc2
Samba Samba	Version 3.0.25 rc3
Samba Samba	Version 3.0.2
Samba Samba	Version 3.0.2a

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (150)

http://docs.info.apple.com/article.html?artnum=306172

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html

Source: secalert@redhat.com

http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html

Source: secalert@redhat.com

http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html

Source: secalert@redhat.com

http://osvdb.org/34699

Source: secalert@redhat.com

http://osvdb.org/34731

Source: secalert@redhat.com

http://osvdb.org/34733

Source: secalert@redhat.com

http://secunia.com/advisories/25232

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25241

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25246

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25251

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25255

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25256

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25257

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25259

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25270

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/25289

Source: secalert@redhat.com

http://secunia.com/advisories/25391/

Source: secalert@redhat.com

http://secunia.com/advisories/25567

Source: secalert@redhat.com

http://secunia.com/advisories/25675

Source: secalert@redhat.com

http://secunia.com/advisories/25772

Source: secalert@redhat.com

http://secunia.com/advisories/26235

Source: secalert@redhat.com

http://secunia.com/advisories/26909

Source: secalert@redhat.com

http://secunia.com/advisories/27706

Source: secalert@redhat.com

http://secunia.com/advisories/28292

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200705-15.xml

Source: secalert@redhat.com

http://securityreason.com/securityalert/2702

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1

Source: secalert@redhat.com

http://www.debian.org/security/2007/dsa-1291

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/773720

Source: secalert@redhat.com

US Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2007:104

Source: secalert@redhat.com

http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html

Source: secalert@redhat.com

http://www.osvdb.org/34732

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2007-0354.html

Source: secalert@redhat.com

Vendor Advisory

http://www.samba.org/samba/security/CVE-2007-2446.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.securityfocus.com/archive/1/468542/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/468670/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/468672/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/468673/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/468674/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/468675/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/468680/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/23973

Source: secalert@redhat.com

http://www.securityfocus.com/bid/24195

Source: secalert@redhat.com

http://www.securityfocus.com/bid/24196

Source: secalert@redhat.com

http://www.securityfocus.com/bid/24197

Source: secalert@redhat.com

http://www.securityfocus.com/bid/24198

Source: secalert@redhat.com

http://www.securityfocus.com/bid/25159

Source: secalert@redhat.com

http://www.securitytracker.com/id?1018050

Source: secalert@redhat.com

http://www.trustix.org/errata/2007/0017/

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-460-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/1805

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2079

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2210

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2281

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2732

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/3229

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2008/0050

Source: secalert@redhat.com

http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf

Source: secalert@redhat.com

http://www.zerodayinitiative.com/advisories/ZDI-07-029.html

Source: secalert@redhat.com

http://www.zerodayinitiative.com/advisories/ZDI-07-030.html

Source: secalert@redhat.com

http://www.zerodayinitiative.com/advisories/ZDI-07-031.html

Source: secalert@redhat.com

http://www.zerodayinitiative.com/advisories/ZDI-07-032.html

Source: secalert@redhat.com

http://www.zerodayinitiative.com/advisories/ZDI-07-033.html

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/34309

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/34311

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/34312

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/34314

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/34316

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-1366

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415

Source: secalert@redhat.com

http://docs.info.apple.com/article.html?artnum=306172