Vulnerability Details : CVE-2007-2446

Public exploit exists!
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Published 2007-05-14 21:19:00
Updated 2025-04-09 00:30:58
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2007-2446

Exploit prediction scoring system (EPSS) score for CVE-2007-2446

EPSS FAQ
80.97%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2007-2446

  • Samba lsa_io_trans_names Heap Overflow
    Disclosure Date: 2007-05-14
    First seen: 2020-04-26
    exploit/solaris/samba/lsa_transnames_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method (credit Ramon and Adriano), which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba
  • Samba lsa_io_trans_names Heap Overflow
    First seen: 2020-04-26
    auxiliary/dos/samba/lsa_transnames_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. Authors: - hdm <x@hdm.io>
  • Samba lsa_io_privilege_set Heap Overflow
    First seen: 2020-04-26
    auxiliary/dos/samba/lsa_addprivs_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. Authors: - hdm <x@hdm.io>
  • Samba lsa_io_trans_names Heap Overflow
    Disclosure Date: 2007-05-14
    First seen: 2020-04-26
    exploit/osx/samba/lsa_transnames_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the szone_free() to overwrite the size() or free() pointer in initial_malloc_zones structure. Authors: - Ramon de C Valle <rcvalle@metasploit.com> - Adriano Lima <adriano
  • Samba lsa_io_trans_names Heap Overflow
    Disclosure Date: 2007-05-14
    First seen: 2020-04-26
    exploit/linux/samba/lsa_transnames_heap
    This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method (credit Ramon and Adriano), which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba

CVSS scores for CVE-2007-2446

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
10.0
 HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
 NIST

CWE ids for CVE-2007-2446

  • The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2007-2446

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close