National Vulnerability Database (CVE-2007-2446)

National Cyber-Alert System Vulnerability Summary: CVE-2007-2446
Orirignal release date: 2007-05-14 Source: US-CERT/NIST ### Overview Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names). ### Impact CVSS Severity: 10.0 (High) Range: network Authentication: input buffer="1" Impact Type: avail,conf,int,sec_prot admin="1" ### Reference to Advisories, Solutions, and Tools External Source: BUGTRAQ Name: 20070513 [SAMBA-SECURITY] CVE-2007-2446: Multiple Heap Overflows Allow Remote Code Execution Hyperlink: http://www.securityfocus.com/archive/1/archive/1/468542/100/0/threaded External Source: NSO Name: http://www.samba.org/samba/security/CVE-2007-2446.html adv=1 patch=1 Hyperlink: http://www.samba.org/samba/security/CVE-2007-2446.html adv=1 patch=1 External Source: NSO Name: https://issues.rpath.com/browse/RPL-1366 Hyperlink: https://issues.rpath.com/browse/RPL-1366 External Source: MANDRIVA Name: MDKSA-2007:104 Hyperlink: http://frontal2.mandriva.com/security/advisories?name=MDKSA-2007:104 External Source: REDHAT Name: RHSA-2007:0354 Hyperlink: http://www.redhat.com/support/errata/RHSA-2007-0354.html External Source: SLACKWARE Name: y=2007& Hyperlink: http://slackware.com/security/viewer.php?l=slackware-security& External Source: CERT-VN Name: VU#773720 Hyperlink: http://www.kb.cert.org/vuls/id/773720 External Source: BID Name: 23973 Hyperlink: http://www.securityfocus.com/bid/23973 External Source: FRSIRT Name: ADV-2007-1805 Hyperlink: http://www.frsirt.com/english/advisories/2007/1805 External Source: SECUNIA Name: 25241 Hyperlink: http://secunia.com/advisories/25241 External Source: SECUNIA Name: 25246 Hyperlink: http://secunia.com/advisories/25246 External Source: SECUNIA Name: 25256 Hyperlink: http://secunia.com/advisories/25256 External Source: SECUNIA Name: 25257 Hyperlink: http://secunia.com/advisories/25257 External Source: BUGTRAQ Name: 20070515 FLEA-2007-0017-1: samba Hyperlink: http://www.securityfocus.com/archive/1/archive/1/468670/100/0/threaded External Source: BUGTRAQ Name: 20070515 ZDI-07-029: Samba lsa_io_privilege_set Heap Overflow Vulnerability Hyperlink: http://www.securityfocus.com/archive/1/archive/1/468674/100/0/threaded External Source: BUGTRAQ Name: 20070515 ZDI-07-030: Samba netdfs_io_dfs_EnumInfo_d Heap Overflow Vulnerability Hyperlink: http://www.securityfocus.com/archive/1/archive/1/468675/100/0/threaded External Source: BUGTRAQ Name: 20070515 ZDI-07-031: Samba smb_io_notify_option_type_data Heap Overflow Vulnerability Hyperlink: http://www.securityfocus.com/archive/1/archive/1/468673/100/0/threaded External Source: BUGTRAQ Name: 20070515 ZDI-07-032: Samba sec_io_acl Heap Overflow Vulnerability Hyperlink: http://www.securityfocus.com/archive/1/archive/1/468672/100/0/threaded External Source: BUGTRAQ Name: 20070515 ZDI-07-033: Samba lsa_io_trans_names Heap Overflow Vulnerability Hyperlink: http://www.securityfocus.com/archive/1/archive/1/468680/100/0/threaded External Source: NSO Name: http://www.zerodayinitiative.com/advisories/ZDI-07-029.html Hyperlink: http://www.zerodayinitiative.com/advisories/ZDI-07-029.html External Source: NSO Name: http://www.zerodayinitiative.com/advisories/ZDI-07-030.html Hyperlink: http://www.zerodayinitiative.com/advisories/ZDI-07-030.html External Source: NSO Name: http://www.zerodayinitiative.com/advisories/ZDI-07-031.html Hyperlink: http://www.zerodayinitiative.com/advisories/ZDI-07-031.html External Source: NSO Name: http://www.zerodayinitiative.com/advisories/ZDI-07-032.html Hyperlink: http://www.zerodayinitiative.com/advisories/ZDI-07-032.html External Source: NSO Name: http://www.zerodayinitiative.com/advisories/ZDI-07-033.html Hyperlink: http://www.zerodayinitiative.com/advisories/ZDI-07-033.html External Source: DEBIAN Name: DSA-1291 Hyperlink: http://www.debian.org/security/2007/dsa-1291 External Source: GENTOO Name: GLSA-200705-15 Hyperlink: http://security.gentoo.org/glsa/glsa-200705-15.xml External Source: TRUSTIX Name: 2007-0017 Hyperlink: http://www.trustix.org/errata/2007/0017/ External Source: UBUNTU Name: USN-460-1 Hyperlink: http://www.ubuntu.com/usn/usn-460-1 External Source: SECTRACK Name: 1018050 Hyperlink: http://www.securitytracker.com/id?1018050 External Source: SECUNIA Name: 25232 Hyperlink: http://secunia.com/advisories/25232 External Source: SECUNIA Name: 25251 Hyperlink: http://secunia.com/advisories/25251 External Source: SECUNIA Name: 25270 Hyperlink: http://secunia.com/advisories/25270 External Source: SECUNIA Name: 25259 Hyperlink: http://secunia.com/advisories/25259 External Source: SECUNIA Name: 25255 Hyperlink: http://secunia.com/advisories/25255 External Source: XF Name: samba-lsaioprivilegeset-bo(34309) Hyperlink: http://xforce.iss.net/xforce/xfdb/34309 External Source: XF Name: samba-lsaiotransnames-bo(34316) Hyperlink: http://xforce.iss.net/xforce/xfdb/34316 External Source: XF Name: samba-netdfsiodfsenuminfod-bo(34311) Hyperlink: http://xforce.iss.net/xforce/xfdb/34311 External Source: XF Name: samba-secioacl-bo(34314) Hyperlink: http://xforce.iss.net/xforce/xfdb/34314 External Source: XF Name: samba-smbionotifyoptiontypedata-bo(34312) Hyperlink: http://xforce.iss.net/xforce/xfdb/34312 ### Vulnerable Software and Vendor Samba (Samba) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2446