National Vulnerability Database (CVE-2007-4138)

National Cyber-Alert System Vulnerability Summary: CVE-2007-4138
Orirignal release date: 2007-09-13 Source: US-CERT/NIST ### Overview The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined. ### Impact CVSS Severity: 6.9 (Medium) Range: local Authentication: Impact Type: avail,conf,int,sec_prot admin="1" ### Reference to Advisories, Solutions, and Tools External Source: BUGTRAQ Name: 20070911 [SECURITY] Winbind&apos Hyperlink: http://www.securityfocus.com/archive/1/archive/1/479078/100/0/threaded External Source: NSO Name: http://www.samba.org/samba/security/CVE-2007-4138.html Hyperlink: http://www.samba.org/samba/security/CVE-2007-4138.html External Source: BID Name: 25636 Hyperlink: http://www.securityfocus.com/bid/25636 External Source: FRSIRT Name: ADV-2007-3120 Hyperlink: http://www.frsirt.com/english/advisories/2007/3120 External Source: SECUNIA Name: 26764 Hyperlink: http://secunia.com/advisories/26764 ### Vulnerable Software and Vendor Samba (Samba) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4138