CVE-2007-2446
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via...
- Published
- May 14, 2007
- Updated
- Aug 7, 2024
- Assigning CNA
- redhat
- Evidence observed
- May 14, 2007
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:CHigh · next 30 days
- Percentile
- 99.6%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Sources
modules/auxiliary/dos/samba/lsa_addprivs_heap.rb
Metasploit Framework modulesDeclared conditions
- verification: check_not_declared($.auxiliary_dos/samba/lsa_addprivs_heap.check)
modules/auxiliary/dos/samba/lsa_transnames_heap.rb
Metasploit Framework modulesDeclared conditions
- verification: check_not_declared($.auxiliary_dos/samba/lsa_transnames_heap.check)
modules/exploits/linux/samba/lsa_transnames_heap.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux($.exploit_linux/samba/lsa_transnames_heap.platform)
- verification: check_declared($.exploit_linux/samba/lsa_transnames_heap.check)
modules/exploits/osx/samba/lsa_transnames_heap.rb
Metasploit Framework modulesDeclared conditions
- platform: OSX($.exploit_osx/samba/lsa_transnames_heap.platform)
- verification: check_not_declared($.exploit_osx/samba/lsa_transnames_heap.check)
modules/exploits/solaris/samba/lsa_transnames_heap.rb
Metasploit Framework modulesDeclared conditions
- platform: Solaris($.exploit_solaris/samba/lsa_transnames_heap.platform)
- verification: check_not_declared($.exploit_solaris/samba/lsa_transnames_heap.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.