// For flags

CVE-2007-4138

samba incorrect primary group assignment for domain users using the rfc2307 or sfu winbind nss info plugin

Severity Score

8.2
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.

La extensión Winbind nss_info (nsswitch/idmap_ad.c) en idmap_ad.so de Samba 3.0.25 hasta 3.0.25c, cuando la opción "winbind nss info" está asignada a rfc2307 ó sfu, concede a todos los usuarios locales el privilegio de gid 0 cuando el atributo de grupo primario (1) RFC2307 ó (2) Services for UNIX (SFU) no está definido.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-08-02 CVE Reserved
  • 2007-09-14 CVE Published
  • 2024-08-07 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (21)
URL Tag Source
http://docs.info.apple.com/article.html?artnum=307179 X_refsource_confirm
http://secunia.com/advisories/26776 Third Party Advisory
http://secunia.com/advisories/26795 Third Party Advisory
http://secunia.com/advisories/26834 Third Party Advisory
http://securityreason.com/securityalert/3135 Third Party Advisory
http://www.samba.org/samba/security/CVE-2007-4138.html X_refsource_confirm
http://www.securityfocus.com/archive/1/479078/100/0/threaded Mailing List
http://www.securitytracker.com/id?1018681 Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA07-352A.html Third Party Advisory
http://www.vupen.com/english/advisories/2007/3120 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/36560 Vdb Entry
https://issues.rpath.com/browse/RPL-1705 X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10375 Signature
URL Date SRC
URL Date SRC
http://secunia.com/advisories/26764 2018-10-15
http://www.securityfocus.com/bid/25636 2018-10-15
URL Date SRC
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.419439 2018-10-15
http://www.redhat.com/support/errata/RHSA-2007-1016.html 2018-10-15
http://www.redhat.com/support/errata/RHSA-2007-1017.html 2018-10-15
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00201.html 2018-10-15
https://access.redhat.com/security/cve/CVE-2007-4138 2007-11-15
https://bugzilla.redhat.com/show_bug.cgi?id=286271 2007-11-15
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Samba
Search vendor "Samba"
 Samba
Search vendor "Samba" for product "Samba"
 3.0.25
Search vendor "Samba" for product "Samba" and version "3.0.25"
-
Affected
Samba
Search vendor "Samba"
 Samba
Search vendor "Samba" for product "Samba"
 3.0.25a
Search vendor "Samba" for product "Samba" and version "3.0.25a"
-
Affected
Samba
Search vendor "Samba"
 Samba
Search vendor "Samba" for product "Samba"
 3.0.25b
Search vendor "Samba" for product "Samba" and version "3.0.25b"
-
Affected
Samba
Search vendor "Samba"
 Samba
Search vendor "Samba" for product "Samba"
 3.0.25c
Search vendor "Samba" for product "Samba" and version "3.0.25c"
-
Affected