CVE-2007-2446
HIGH 10.0EPSS 77.7%
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
- CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 77.66% chance of exploitation in the next 30 days, 100th percentile
- Published
- 2007-05-14
- Updated
- 2024-08-07
Metasploit modules (5)
- rapid7/metasploit-framework/blob/master/modules/exploits/linux/samba/lsa_transnames_heap…
- rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/samba/lsa_addprivs_heap.rb
- rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/samba/lsa_transnames_heap.rb
- rapid7/metasploit-framework/blob/master/modules/exploits/osx/samba/lsa_transnames_heap.rb
- rapid7/metasploit-framework/blob/master/modules/exploits/solaris/samba/lsa_transnames_hea…
ExploitDB entries (4)
- https://www.exploit-db.com/exploits/16875
- https://www.exploit-db.com/exploits/16859
- https://www.exploit-db.com/exploits/16329
- https://www.exploit-db.com/exploits/9950
Security advisories
- http://secunia.com/advisories/25232
- http://secunia.com/advisories/25241
- http://secunia.com/advisories/25246
- http://secunia.com/advisories/25251
- http://secunia.com/advisories/25255
- http://secunia.com/advisories/25256
- http://secunia.com/advisories/25257
- http://secunia.com/advisories/25259
- http://secunia.com/advisories/25270
- http://www.redhat.com/support/errata/RHSA-2007-0354.html
- http://www.samba.org/samba/security/CVE-2007-2446.html
- http://www.kb.cert.org/vuls/id/773720
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:104
- http://www.securityfocus.com/bid/23973
- http://www.securityfocus.com/bid/24195
- http://www.securityfocus.com/bid/24196
- http://www.securityfocus.com/bid/24197
- http://www.securityfocus.com/bid/24198
- http://www.securityfocus.com/bid/25159
- http://www.ubuntu.com/usn/usn-460-1