CVE-2007-2446

Samba lsa_io_trans_names Heap Overflow Vulnerability

Severity Score

10.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).

Múltiples desbordamientos de búfer en la región heap de la memoria en el análisis NDR en smbd en Samba versión 3.0.0 hasta 3.0.25rc3 permiten que los atacantes remotos ejecuten código arbitrario por medio de peticiones MS-RPC creadas que involucran (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), o (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_name).

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Samba. User interaction is not required to exploit this vulnerability.
The specific flaw exists in the parsing of RPC requests to the LSA RPC interface. When parsing a request to LsarLookupSids/LsarLookupSids2, heap allocation is calculated based on user input. By specifying invalid values, heap blocks can be overwritten leading to remote code execution.

*Credits: Anonymous

CVSS Scores

NISTv2 10.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-05-02 CVE Reserved
2007-05-14 CVE Published
2007-05-14 First Exploit
2024-08-07 CVE Updated
2024-08-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (82)

URL	Tag	Source
http://docs.info.apple.com/article.html?artnum=306172	X_refsource_confirm
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html	Mailing List
http://osvdb.org/34699	Vdb Entry
http://osvdb.org/34731	Vdb Entry
http://osvdb.org/34733	Vdb Entry
http://secunia.com/advisories/25289	Third Party Advisory
http://secunia.com/advisories/25391	Third Party Advisory
http://secunia.com/advisories/25567	Third Party Advisory
http://secunia.com/advisories/25675	Third Party Advisory
http://secunia.com/advisories/25772	Third Party Advisory
http://secunia.com/advisories/26235	Third Party Advisory
http://secunia.com/advisories/26909	Third Party Advisory
http://secunia.com/advisories/27706	Third Party Advisory
http://secunia.com/advisories/28292	Third Party Advisory
http://securityreason.com/securityalert/2702	Third Party Advisory
http://www.kb.cert.org/vuls/id/773720	Third Party Advisory
http://www.osvdb.org/34732	Vdb Entry
http://www.securityfocus.com/archive/1/468542/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/468670/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/468672/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/468673/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/468674/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/468675/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/468680/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/23973	Vdb Entry
http://www.securityfocus.com/bid/24195	Vdb Entry
http://www.securityfocus.com/bid/24196	Vdb Entry
http://www.securityfocus.com/bid/24197	Vdb Entry
http://www.securityfocus.com/bid/24198	Vdb Entry
http://www.securityfocus.com/bid/25159	Vdb Entry
http://www.securitytracker.com/id?1018050	Vdb Entry
http://www.vupen.com/english/advisories/2007/1805	Vdb Entry
http://www.vupen.com/english/advisories/2007/2079	Vdb Entry
http://www.vupen.com/english/advisories/2007/2210	Vdb Entry
http://www.vupen.com/english/advisories/2007/2281	Vdb Entry
http://www.vupen.com/english/advisories/2007/2732	Vdb Entry
http://www.vupen.com/english/advisories/2007/3229	Vdb Entry
http://www.vupen.com/english/advisories/2008/0050	Vdb Entry
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf	X_refsource_confirm
http://www.zerodayinitiative.com/advisories/ZDI-07-029.html	X_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-07-030.html	X_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-07-031.html	X_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-07-032.html	X_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-07-033.html	X_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/34309	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34311	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34312	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34314	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/34316	Vdb Entry
https://issues.rpath.com/browse/RPL-1366	X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415	Signature
-

URL	Date	SRC
https://www.exploit-db.com/exploits/9950	2007-05-14
https://www.exploit-db.com/exploits/16859	2010-07-14
https://www.exploit-db.com/exploits/16875	2010-04-05
https://www.exploit-db.com/exploits/16329	2010-04-05

URL	Date	SRC
http://www.samba.org/samba/security/CVE-2007-2446.html	2018-10-16

URL	Date	SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768	2018-10-16
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980	2018-10-16
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	2018-10-16
http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html	2018-10-16
http://secunia.com/advisories/25232	2018-10-16
http://secunia.com/advisories/25241	2018-10-16
http://secunia.com/advisories/25246	2018-10-16
http://secunia.com/advisories/25251	2018-10-16
http://secunia.com/advisories/25255	2018-10-16
http://secunia.com/advisories/25256	2018-10-16
http://secunia.com/advisories/25257	2018-10-16
http://secunia.com/advisories/25259	2018-10-16
http://secunia.com/advisories/25270	2018-10-16
http://security.gentoo.org/glsa/glsa-200705-15.xml	2018-10-16
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906	2018-10-16
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1	2018-10-16
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1	2018-10-16
http://www.debian.org/security/2007/dsa-1291	2018-10-16
http://www.mandriva.com/security/advisories?name=MDKSA-2007:104	2018-10-16
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html	2018-10-16
http://www.redhat.com/support/errata/RHSA-2007-0354.html	2018-10-16
http://www.trustix.org/errata/2007/0017	2018-10-16
http://www.ubuntu.com/usn/usn-460-1	2018-10-16
https://access.redhat.com/security/cve/CVE-2007-2446	2007-05-14
https://bugzilla.redhat.com/show_bug.cgi?id=239429	2007-05-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.0 Search vendor "Samba" for product "Samba" and version "3.0.0"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.1 Search vendor "Samba" for product "Samba" and version "3.0.1"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.2 Search vendor "Samba" for product "Samba" and version "3.0.2"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.2a Search vendor "Samba" for product "Samba" and version "3.0.2a"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.10 Search vendor "Samba" for product "Samba" and version "3.0.10"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.11 Search vendor "Samba" for product "Samba" and version "3.0.11"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.12 Search vendor "Samba" for product "Samba" and version "3.0.12"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.13 Search vendor "Samba" for product "Samba" and version "3.0.13"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.14 Search vendor "Samba" for product "Samba" and version "3.0.14"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.14a Search vendor "Samba" for product "Samba" and version "3.0.14a"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.15 Search vendor "Samba" for product "Samba" and version "3.0.15"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.16 Search vendor "Samba" for product "Samba" and version "3.0.16"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.17 Search vendor "Samba" for product "Samba" and version "3.0.17"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.18 Search vendor "Samba" for product "Samba" and version "3.0.18"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.19 Search vendor "Samba" for product "Samba" and version "3.0.19"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.20 Search vendor "Samba" for product "Samba" and version "3.0.20"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.20a Search vendor "Samba" for product "Samba" and version "3.0.20a"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.20b Search vendor "Samba" for product "Samba" and version "3.0.20b"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.21 Search vendor "Samba" for product "Samba" and version "3.0.21"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.21a Search vendor "Samba" for product "Samba" and version "3.0.21a"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.21b Search vendor "Samba" for product "Samba" and version "3.0.21b"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.21c Search vendor "Samba" for product "Samba" and version "3.0.21c"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.22 Search vendor "Samba" for product "Samba" and version "3.0.22"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.23 Search vendor "Samba" for product "Samba" and version "3.0.23"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.23a Search vendor "Samba" for product "Samba" and version "3.0.23a"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.23b Search vendor "Samba" for product "Samba" and version "3.0.23b"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.23c Search vendor "Samba" for product "Samba" and version "3.0.23c"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.23d Search vendor "Samba" for product "Samba" and version "3.0.23d"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.24 Search vendor "Samba" for product "Samba" and version "3.0.24"		-		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.25 Search vendor "Samba" for product "Samba" and version "3.0.25"		pre1		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.25 Search vendor "Samba" for product "Samba" and version "3.0.25"		pre2		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.25 Search vendor "Samba" for product "Samba" and version "3.0.25"		rc1		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.25 Search vendor "Samba" for product "Samba" and version "3.0.25"		rc2		Affected
Samba Search vendor "Samba"		Samba Search vendor "Samba" for product "Samba"				3.0.25 Search vendor "Samba" for product "Samba" and version "3.0.25"		rc3		Affected