10.0
CRITICAL
CVE-2007-2446
Samba Buffer Overflows via Malformed NDR Parsing
Description

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).

INFO

Published Date :

May 14, 2007, 9:19 p.m.

Last Modified :

Oct. 16, 2018, 4:43 p.m.

Remotely Exploitable :

Yes !

Impact Score :

10.0

Exploitability Score :

10.0
Public PoC/Exploit Available at Github

CVE-2007-2446 has a 5 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2007-2446 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Samba samba
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2007-2446.

URL Resource
http://docs.info.apple.com/article.html?artnum=306172
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html
http://osvdb.org/34699
http://osvdb.org/34731
http://osvdb.org/34733
http://secunia.com/advisories/25232 Vendor Advisory
http://secunia.com/advisories/25241 Vendor Advisory
http://secunia.com/advisories/25246 Vendor Advisory
http://secunia.com/advisories/25251 Vendor Advisory
http://secunia.com/advisories/25255 Vendor Advisory
http://secunia.com/advisories/25256 Vendor Advisory
http://secunia.com/advisories/25257 Vendor Advisory
http://secunia.com/advisories/25259 Vendor Advisory
http://secunia.com/advisories/25270 Vendor Advisory
http://secunia.com/advisories/25289
http://secunia.com/advisories/25391/
http://secunia.com/advisories/25567
http://secunia.com/advisories/25675
http://secunia.com/advisories/25772
http://secunia.com/advisories/26235
http://secunia.com/advisories/26909
http://secunia.com/advisories/27706
http://secunia.com/advisories/28292
http://security.gentoo.org/glsa/glsa-200705-15.xml
http://securityreason.com/securityalert/2702
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1
http://www.debian.org/security/2007/dsa-1291
http://www.kb.cert.org/vuls/id/773720 US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2007:104
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html
http://www.osvdb.org/34732
http://www.redhat.com/support/errata/RHSA-2007-0354.html Vendor Advisory
http://www.samba.org/samba/security/CVE-2007-2446.html Patch Vendor Advisory
http://www.securityfocus.com/archive/1/468542/100/0/threaded
http://www.securityfocus.com/archive/1/468670/100/0/threaded
http://www.securityfocus.com/archive/1/468672/100/0/threaded
http://www.securityfocus.com/archive/1/468673/100/0/threaded
http://www.securityfocus.com/archive/1/468674/100/0/threaded
http://www.securityfocus.com/archive/1/468675/100/0/threaded
http://www.securityfocus.com/archive/1/468680/100/0/threaded
http://www.securityfocus.com/bid/23973
http://www.securityfocus.com/bid/24195
http://www.securityfocus.com/bid/24196
http://www.securityfocus.com/bid/24197
http://www.securityfocus.com/bid/24198
http://www.securityfocus.com/bid/25159
http://www.securitytracker.com/id?1018050
http://www.trustix.org/errata/2007/0017/
http://www.ubuntu.com/usn/usn-460-1
http://www.vupen.com/english/advisories/2007/1805
http://www.vupen.com/english/advisories/2007/2079
http://www.vupen.com/english/advisories/2007/2210
http://www.vupen.com/english/advisories/2007/2281
http://www.vupen.com/english/advisories/2007/2732
http://www.vupen.com/english/advisories/2007/3229
http://www.vupen.com/english/advisories/2008/0050
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf
http://www.zerodayinitiative.com/advisories/ZDI-07-029.html
http://www.zerodayinitiative.com/advisories/ZDI-07-030.html
http://www.zerodayinitiative.com/advisories/ZDI-07-031.html
http://www.zerodayinitiative.com/advisories/ZDI-07-032.html
http://www.zerodayinitiative.com/advisories/ZDI-07-033.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/34309
https://exchange.xforce.ibmcloud.com/vulnerabilities/34311
https://exchange.xforce.ibmcloud.com/vulnerabilities/34312
https://exchange.xforce.ibmcloud.com/vulnerabilities/34314
https://exchange.xforce.ibmcloud.com/vulnerabilities/34316
https://issues.rpath.com/browse/RPL-1366
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

C Perl 6 Perl ASP HTML Rich Text Format Visual Basic TeX Assembly Shell

Updated: 3 months, 1 week ago
1 stars 1 fork 1 watcher
Born at : June 13, 2019, 1:51 p.m. This repo has been linked 308 different CVEs too.

None

Makefile Python API Blueprint OpenEdge ABL Shell Java HTML Dockerfile JavaScript

Updated: 6 years, 2 months ago
0 stars 1 fork 1 watcher
Born at : Jan. 10, 2017, 10:44 a.m. This repo has been linked 1 different CVEs too.

None

Python JavaScript PHP Go HTML

Updated: 1 year, 9 months ago
5 stars 4 fork 4 watcher
Born at : Nov. 3, 2015, 3:58 p.m. This repo has been linked 1 different CVEs too.

FIWARE Cyber seCurity Attack graPh moniTORing - Server (Computing)

Shell Java HTML OpenEdge ABL API Blueprint

Updated: 3 years, 10 months ago
5 stars 5 fork 5 watcher
Born at : Aug. 10, 2015, 12:25 p.m. This repo has been linked 1 different CVEs too.

The vm images in this repo are lost, we recommend our new project: https://github.com/hust-open-atom-club/S2VulnHub

linux vulnerability reproduction cve edb

Shell C Perl PHP TeX Python Assembly Makefile HTML XSLT

Updated: 2 months, 2 weeks ago
327 stars 70 fork 70 watcher
Born at : July 30, 2015, 10:36 a.m. This repo has been linked 309 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2007-2446 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2007-2446 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Oct. 16, 2018

    Action Type Old Value New Value
    Removed Reference http://www.securityfocus.com/archive/1/archive/1/468675/100/0/threaded [No Types Assigned]
    Removed Reference http://www.securityfocus.com/archive/1/archive/1/468542/100/0/threaded [Patch]
    Removed Reference http://www.securityfocus.com/archive/1/archive/1/468670/100/0/threaded [No Types Assigned]
    Removed Reference http://www.securityfocus.com/archive/1/archive/1/468680/100/0/threaded [No Types Assigned]
    Removed Reference http://www.securityfocus.com/archive/1/archive/1/468674/100/0/threaded [No Types Assigned]
    Removed Reference http://www.securityfocus.com/archive/1/archive/1/468672/100/0/threaded [No Types Assigned]
    Removed Reference http://www.securityfocus.com/archive/1/archive/1/468673/100/0/threaded [No Types Assigned]
    Added Reference http://www.securityfocus.com/archive/1/468680/100/0/threaded [No Types Assigned]
    Added Reference http://www.securityfocus.com/archive/1/468675/100/0/threaded [No Types Assigned]
    Added Reference http://www.securityfocus.com/archive/1/468674/100/0/threaded [No Types Assigned]
    Added Reference http://www.securityfocus.com/archive/1/468673/100/0/threaded [No Types Assigned]
    Added Reference http://www.securityfocus.com/archive/1/468672/100/0/threaded [No Types Assigned]
    Added Reference http://www.securityfocus.com/archive/1/468670/100/0/threaded [No Types Assigned]
    Added Reference http://www.securityfocus.com/archive/1/468542/100/0/threaded [No Types Assigned]
  • CVE Modified by [email protected]

    Oct. 11, 2017

    Action Type Old Value New Value
    Removed Reference http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11415 [No Types Assigned]
    Added Reference https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415 [No Types Assigned]
  • CVE Modified by [email protected]

    Jul. 29, 2017

    Action Type Old Value New Value
    Removed Reference http://xforce.iss.net/xforce/xfdb/34314 [No Types Assigned]
    Removed Reference http://xforce.iss.net/xforce/xfdb/34316 [No Types Assigned]
    Removed Reference http://xforce.iss.net/xforce/xfdb/34311 [No Types Assigned]
    Removed Reference http://xforce.iss.net/xforce/xfdb/34309 [No Types Assigned]
    Removed Reference http://xforce.iss.net/xforce/xfdb/34312 [No Types Assigned]
    Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/34316 [No Types Assigned]
    Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/34314 [No Types Assigned]
    Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/34312 [No Types Assigned]
    Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/34311 [No Types Assigned]
    Added Reference https://exchange.xforce.ibmcloud.com/vulnerabilities/34309 [No Types Assigned]
  • Initial Analysis by [email protected]

    May. 16, 2007

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

96.48 }} 0.10%

score

0.99622

percentile

CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability