ID CVE-2007-2447
Summary The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.
References
Vulnerable Configurations
  • Samba 3.0.0
    cpe:2.3:a:samba:samba:3.0.0
  • Samba 3.0.1
    cpe:2.3:a:samba:samba:3.0.1
  • Samba 3.0.2
    cpe:2.3:a:samba:samba:3.0.2
  • Samba 3.0.2a
    cpe:2.3:a:samba:samba:3.0.2a
  • Samba 3.0.3
    cpe:2.3:a:samba:samba:3.0.3
  • Samba 3.0.4
    cpe:2.3:a:samba:samba:3.0.4
  • Samba 3.0.4 release candidate 1
    cpe:2.3:a:samba:samba:3.0.4:rc1
  • Samba 3.0.5
    cpe:2.3:a:samba:samba:3.0.5
  • Samba 3.0.6
    cpe:2.3:a:samba:samba:3.0.6
  • Samba 3.0.7
    cpe:2.3:a:samba:samba:3.0.7
  • Samba 3.0.8
    cpe:2.3:a:samba:samba:3.0.8
  • Samba 3.0.9
    cpe:2.3:a:samba:samba:3.0.9
  • Samba 3.0.10
    cpe:2.3:a:samba:samba:3.0.10
  • Samba 3.0.11
    cpe:2.3:a:samba:samba:3.0.11
  • Samba 3.0.12
    cpe:2.3:a:samba:samba:3.0.12
  • Samba 3.0.13
    cpe:2.3:a:samba:samba:3.0.13
  • Samba 3.0.14
    cpe:2.3:a:samba:samba:3.0.14
  • Samba 3.0.14a
    cpe:2.3:a:samba:samba:3.0.14a
  • Samba 3.0.15
    cpe:2.3:a:samba:samba:3.0.15
  • Samba 3.0.16
    cpe:2.3:a:samba:samba:3.0.16
  • Samba 3.0.17
    cpe:2.3:a:samba:samba:3.0.17
  • Samba 3.0.18
    cpe:2.3:a:samba:samba:3.0.18
  • Samba 3.0.19
    cpe:2.3:a:samba:samba:3.0.19
  • Samba 3.0.20
    cpe:2.3:a:samba:samba:3.0.20
  • Samba 3.0.20a
    cpe:2.3:a:samba:samba:3.0.20a
  • Samba 3.0.20b
    cpe:2.3:a:samba:samba:3.0.20b
  • Samba 3.0.21
    cpe:2.3:a:samba:samba:3.0.21
  • Samba 3.0.21a
    cpe:2.3:a:samba:samba:3.0.21a
  • Samba 3.0.21b
    cpe:2.3:a:samba:samba:3.0.21b
  • Samba 3.0.21c
    cpe:2.3:a:samba:samba:3.0.21c
  • Samba 3.0.22
    cpe:2.3:a:samba:samba:3.0.22
  • Samba 3.0.23
    cpe:2.3:a:samba:samba:3.0.23
  • Samba 3.0.23a
    cpe:2.3:a:samba:samba:3.0.23a
  • Samba 3.0.23b
    cpe:2.3:a:samba:samba:3.0.23b
  • Samba 3.0.23c
    cpe:2.3:a:samba:samba:3.0.23c
  • Samba 3.0.23d
    cpe:2.3:a:samba:samba:3.0.23d
  • Samba 3.0.24
    cpe:2.3:a:samba:samba:3.0.24
  • Samba 3.0.25 pre1
    cpe:2.3:a:samba:samba:3.0.25:pre1
  • Samba 3.0.25 pre2
    cpe:2.3:a:samba:samba:3.0.25:pre2
  • Samba 3.0.25 release candidate 1
    cpe:2.3:a:samba:samba:3.0.25:rc1
  • Samba 3.0.25 release candiate 2
    cpe:2.3:a:samba:samba:3.0.25:rc2
  • Samba 3.0.25 release candidate 3
    cpe:2.3:a:samba:samba:3.0.25:rc3
CVSS
Base: 6.0 (as of 16-05-2007 - 12:46)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
exploit-db via4
description Samba "username map script" Command Execution. CVE-2007-2447. Remote exploit for unix platform
id EDB-ID:16320
last seen 2016-02-01
modified 2010-08-18
published 2010-08-18
reporter metasploit
source https://www.exploit-db.com/download/16320/
title Samba "username map script" Command Execution
metasploit via4
description This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute arbitrary commands. No authentication is needed to exploit this vulnerability since this option is used to map usernames prior to authentication!
id MSF:EXPLOIT/MULTI/SAMBA/USERMAP_SCRIPT
last seen 2019-02-27
modified 2017-07-24
published 2010-02-16
reliability Excellent
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/samba/usermap_script.rb
title Samba "username map script" Command Execution
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SAMBA-3827.NASL
    description The previous security fix for CVE-2007-2447 missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27431
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27431
    title openSUSE 10 Security Update : samba (samba-3827)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2007-506.NASL
    description This release of Samba fixes some Serious security bugs : - CVE-2007-2444 - CVE-2007-2446 - CVE-2007-2447 Official upstream announcements here: http://www.samba.org/samba/security/CVE-2007-2444.html http://www.samba.org/samba/security/CVE-2007-2446.html http://www.samba.org/samba/security/CVE-2007-2447.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-20
    plugin id 25233
    published 2007-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25233
    title Fedora Core 5 : samba-3.0.24-5.fc5 (2007-506)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2007-507.NASL
    description This release of Samba fixes some Serious security bugs : - CVE-2007-2444 - CVE-2007-2446 - CVE-2007-2447 Official upstream announcements here: http://www.samba.org/samba/security/CVE-2007-2444.html http://www.samba.org/samba/security/CVE-2007-2446.html http://www.samba.org/samba/security/CVE-2007-2447.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-20
    plugin id 25234
    published 2007-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25234
    title Fedora Core 6 : samba-3.0.24-5.fc6 (2007-507)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2007-0006.NASL
    description Problems addressed by these patches : I Arbitrary code execution and denial of service vulnerabilities This release fixes a security vulnerability that could allow a guest operating system user with administrative privileges to cause memory corruption in a host process, and thus potentially execute arbitrary code on the host. (CVE-2007-4496) This release fixes a denial of service vulnerability that could allow a guest operating system to cause a host process to become unresponsive or exit unexpectedly. (CVE-2007-4497) Thanks to Rafal Wojtczvk of McAfee for identifying and reporting these issues. II Hosted products DHCP security vulnerabilities addressed This release fixes several vulnerabilities in the DHCP server that could enable a specially crafted packets to gain system-level privileges. (CVE-2007-0061, CVE-2007-0062, CVE-2007-0063) Thanks to Neel Mehta and Ryan Smith of the IBM Internet Security Systems X-Force for discovering and researching these vulnerabilities. III Windows based hosted product vulnerability in IntraProcessLogging.dll and vielib.dll. This release fixes a security vulnerability that could allow a malicious remote user to exploit the library file IntraProcessLogging.dll to overwrite files in a system. (CVE-2007-4059) This release fixes a security vulnerability that could allow a malicious remote user to exploit the library file vielib.dll to overwrite files in a system. (CVE-2007-4155) Thanks to the Goodfellas Security Research Team for discovering and researching these vulnerabilities. IV Escalation of privileges on Windows hosted systems This release fixes a security vulnerability in which Workstation was starting registered Windows services in an insecure manner. This vulnerability could allow a malicious user to escalate user privileges. Thanks to Foundstone for discovering this vulnerability. V Potential denial of service using VMware Player This release fixes a problem that prevented VMware Player from launching. This problem was accompanied by the error message VMware Player unrecoverable error: (player) Exception 0xc0000005 (access violation) has occurred. VI ESX Service Console updates a. Service console package Samba, has been updated to address the following issues : Various bugs were found in NDR parsing, used to decode MS-RPC requests in Samba. A remote attacker could have sent carefully crafted requests causing a heap overflow, which may have led to the ability to execute arbitrary code on the server. (CVE-2007-2446) Unescaped user input parameters were being passed as arguments to /bin/sh. A remote, authenticated, user could have triggered this flaw and executed arbitrary code on the server. Additionally, this flaw could be triggered by a remote unauthenticated user if Samba was configured to use the non-default username map script option. (CVE-2007-2447) Thanks to the Samba developers, TippingPoint, and iDefense for identifying and reporting these issues. Note: These issues only affect the service console network, and are not remote vulnerabilities for ESX Server hosts that have been set up with the security best practices provided by VMware. http://www.vmware.com/resources/techresources/726 b. Updated bind package for the service console fixes a flaw with the way ISC BIND processed certain DNS query responses. ISC BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. Under some circumstances, a malicious remote user could launch a Denial-of-Service attack on ESX Server hosts that had enabled DNSSEC validation. (CVE-2007-0494) Note: These issues only affect the service console network, and are not remote vulnerabilities for ESX Server hosts that have been set up with the security best practices provided by VMware. http://www.vmware.com/resources/techresources/726 c. This patch provides updated service console package krb5 update. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the names CVE-2007-2442, CVE-2007-2443, and CVE-2007-2798 to these security issues. Thanks to Wei Wang of McAfee Avert Labs discovered these vulnerabilities. Note: The VMware service console does not provide the kadmind binary, and is not affected by these issues, but a update has been provided for completeness. d. Service console update for vixie-cron This patch provides an updated service console package vixie-cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times. A denial of service issue was found in the way vixie-cron verified crontab file integrity. A local user with the ability to create a hardlink to /etc/crontab could potentially prevent vixie-cron from executing certain system cron jobs. (CVE-2007-1856) Thanks to Raphael Marichez for identifying this issue. e. Service console update for shadow-utils This patch provides an updated shadow-utils package. A new user's mailbox, when created, could have random permissions for a short period. This could enable a local malicious user to read or modify the mailbox. (CVE-2006-1174) f. Service console update for OpenLDAP This patch provides a updated OpenLDAP package. A flaw could allow users with selfwrite access to modify the distinguished name of any user, instead of being limited to modify only their own distinguished name. (CVE-2006-4600) g. Service console update for PAM This patch provides an updated PAM package A vulnerability was found that could allow console users with access to certain device files to cause damage to recordable CD drives. Certain file permissions have now been modified to disallow access. (CVE-2004-0813) A flaw was found with console device permissions. It was possible for various console devices to retain ownership of the previoius console user after logging out, which could result in leakage of information to an unauthorized user. (CVE-2007-1716) h. Service console update for GCC This patch provides security fixes for the service console GNU Compiler Collection (GCC) packages that include C, C++, Java, Fortran 77, Objective C, and Ada 95 GNU compilers and related support libraries. A flaw was found in the fastjar utility that could potentially allow a malicious user to create a JAR file which, if unpacked using fastjar, could write to any file that an authorized user had write access to. (CVE-2006-3619) Thanks to Jürgen Weigert for identifying this issue. i. Service Console update for GDB This patch provides a security fix for the service console GNU debugger (GDB). Various vulnerabilities were found in GDB. These vulnerabilities may allow a malicious user to deceive a user into loading debugging information into GDB, enabling the execution of arbitrary code with the privileges of the user. (CVE-2006-4146)
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 40370
    published 2009-07-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=40370
    title VMSA-2007-0006 : Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SAMBA-3829.NASL
    description The previous security fix for CVE-2007-2447 missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update.
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29577
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29577
    title SuSE 10 Security Update : Samba (ZYPP Patch Number 3829)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2007-007.NASL
    description The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. This update contains several security fixes for the following programs : - bzip2 - CFNetwork - CoreAudio - cscope - gnuzip - iChat - Kerberos - mDNSResponder - PDFKit - PHP - Quartz Composer - Samba - SquirrelMail - Tomcat - WebCore - WebKit
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 25830
    published 2007-08-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25830
    title Mac OS X Multiple Vulnerabilities (Security Update 2007-007)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SAMBA-3828.NASL
    description The previous security fix for CVE-2007-2447 missed one character in the shell escape handling. Also fixed were some regressions introduced by the previous update.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27432
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27432
    title openSUSE 10 Security Update : samba (samba-3828)
  • NASL family Misc.
    NASL id SAMBA_3_LOGIN_RCE.NASL
    description The version of Samba running on the remote host is affected by a remote code execution vulnerability due to improper validation of user-supplied input when passing RPC messages from external scripts to a shell. A remote, authenticated attacker can exploit this via the use of shell metacharacters during login negotiations when the 'username map script' option is enabled, or during the invocation of other printer and file management MS-RPC calls.
    last seen 2019-02-21
    modified 2018-07-30
    plugin id 82580
    published 2015-04-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82580
    title Samba 3.0.0 'SamrChangePassword' RCE
  • NASL family Misc.
    NASL id XEROX_XRX08_001.NASL
    description According to its model number and software version, the remote host is a Xerox WorkCentre device that reportedly is affected by multiple buffer overflow and remote command injection issues. Using specially- crafted RPC requests, an unauthenticated attacker could leverage these issues to run arbitrary code on the affected device or make unauthorized changes to its system configuration.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 29965
    published 2008-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29965
    title Xerox WorkCentre Multiple Samba Vulnerabilities (XRX08-001)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0354.NASL
    description From Red Hat Security Advisory 2007:0354 : Updated samba packages that fix several security flaws are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. Samba provides file and printer sharing services to SMB/CIFS clients. Various bugs were found in NDR parsing, used to decode MS-RPC requests in Samba. A remote attacker could have sent carefully crafted requests causing a heap overflow, which may have led to the ability to execute arbitrary code on the server. (CVE-2007-2446) Unescaped user input parameters were being passed as arguments to /bin/sh. A remote, authenticated, user could have triggered this flaw and executed arbitrary code on the server. Additionally, on Red Hat Enterprise Linux 5 only, this flaw could be triggered by a remote unauthenticated user if Samba was configured to use the non-default 'username map script' option. (CVE-2007-2447) Users of Samba should upgrade to these packages, which contain backported patches to correct these issues. After upgrading, Samba should be restarted using 'service smb restart' On Red Hat Enterprise Linux 5 the impact of these issues is reduced as Samba is constrained by the default SELinux 'targeted' policy. Red Hat would like to thank the Samba developers, TippingPoint, and iDefense for reporting these issues.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67499
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67499
    title Oracle Linux 3 / 4 / 5 : samba (ELSA-2007-0354)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SAMBA-3349.NASL
    description Specially crafted MS-RPC packets could overwrite heap memory and therfore could potentially be exploited to execute code (CVE-2007-2446). Authenticated users could leverage specially crafted MS-RPC packets to pass arguments unfiltered to /bin/sh (CVE-2007-2447).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27429
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27429
    title openSUSE 10 Security Update : samba (samba-3349)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2007-134-01.NASL
    description New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, and -current to fix security issues.
    last seen 2019-02-21
    modified 2018-06-27
    plugin id 25222
    published 2007-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25222
    title Slackware 10.0 / 10.1 / 10.2 / 11.0 / current : samba (SSA:2007-134-01)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-460-1.NASL
    description Paul Griffith and Andrew Hogue discovered that Samba did not fully drop root privileges while translating SIDs. A remote authenticated user could issue SMB operations during a small window of opportunity and gain root privileges. (CVE-2007-2444) Brian Schafer discovered that Samba did not handle NDR parsing correctly. A remote attacker could send specially crafted MS-RPC requests that could overwrite heap memory and execute arbitrary code. (CVE-2007-2446) It was discovered that Samba did not correctly escape input parameters for external scripts defined in smb.conf. Remote authenticated users could send specially crafted MS-RPC requests and execute arbitrary shell commands. (CVE-2007-2447). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 28059
    published 2007-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28059
    title Ubuntu 6.06 LTS / 6.10 / 7.04 : samba vulnerabilities (USN-460-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1291.NASL
    description Several issues have been identified in Samba, the SMB/CIFS file- and print-server implementation for GNU/Linux. - CVE-2007-2444 When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish addition means of gaining root access to the server. - CVE-2007-2446 Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data. - CVE-2007-2447 Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 25228
    published 2007-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25228
    title Debian DSA-1291-1 : samba - several vulnerabilities
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200705-15.NASL
    description The remote host is affected by the vulnerability described in GLSA-200705-15 (Samba: Multiple vulnerabilities) Samba contains a logical error in the smbd daemon when translating local SID to user names (CVE-2007-2444). Furthermore, Samba contains several bugs when parsing NDR encoded RPC parameters (CVE-2007-2446). Lastly, Samba fails to properly sanitize remote procedure input provided via Microsoft Remote Procedure Calls (CVE-2007-2447). Impact : A remote attacker could exploit these vulnerabilities to gain root privileges via various vectors. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 25236
    published 2007-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25236
    title GLSA-200705-15 : Samba: Multiple vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0354.NASL
    description Updated samba packages that fix several security flaws are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. Samba provides file and printer sharing services to SMB/CIFS clients. Various bugs were found in NDR parsing, used to decode MS-RPC requests in Samba. A remote attacker could have sent carefully crafted requests causing a heap overflow, which may have led to the ability to execute arbitrary code on the server. (CVE-2007-2446) Unescaped user input parameters were being passed as arguments to /bin/sh. A remote, authenticated, user could have triggered this flaw and executed arbitrary code on the server. Additionally, on Red Hat Enterprise Linux 5 only, this flaw could be triggered by a remote unauthenticated user if Samba was configured to use the non-default 'username map script' option. (CVE-2007-2447) Users of Samba should upgrade to these packages, which contain backported patches to correct these issues. After upgrading, Samba should be restarted using 'service smb restart' On Red Hat Enterprise Linux 5 the impact of these issues is reduced as Samba is constrained by the default SELinux 'targeted' policy. Red Hat would like to thank the Samba developers, TippingPoint, and iDefense for reporting these issues.
    last seen 2019-02-21
    modified 2018-11-27
    plugin id 25239
    published 2007-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25239
    title RHEL 2.1 / 3 / 4 / 5 : samba (RHSA-2007:0354)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0354.NASL
    description Updated samba packages that fix several security flaws are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. Samba provides file and printer sharing services to SMB/CIFS clients. Various bugs were found in NDR parsing, used to decode MS-RPC requests in Samba. A remote attacker could have sent carefully crafted requests causing a heap overflow, which may have led to the ability to execute arbitrary code on the server. (CVE-2007-2446) Unescaped user input parameters were being passed as arguments to /bin/sh. A remote, authenticated, user could have triggered this flaw and executed arbitrary code on the server. Additionally, on Red Hat Enterprise Linux 5 only, this flaw could be triggered by a remote unauthenticated user if Samba was configured to use the non-default 'username map script' option. (CVE-2007-2447) Users of Samba should upgrade to these packages, which contain backported patches to correct these issues. After upgrading, Samba should be restarted using 'service smb restart' On Red Hat Enterprise Linux 5 the impact of these issues is reduced as Samba is constrained by the default SELinux 'targeted' policy. Red Hat would like to thank the Samba developers, TippingPoint, and iDefense for reporting these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25224
    published 2007-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25224
    title CentOS 3 / 4 / 5 : samba (CESA-2007:0354)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20070514_SAMBA_ON_SL5_X.NASL
    description Various bugs were found in NDR parsing, used to decode MS-RPC requests in Samba. A remote attacker could have sent carefully crafted requests causing a heap overflow, which may have led to the ability to execute arbitrary code on the server. (CVE-2007-2446) Unescaped user input parameters were being passed as arguments to /bin/sh. A remote, authenticated, user could have triggered this flaw and executed arbitrary code on the server. Additionally on Scientific Linux 5 this flaw could be triggered by a remote unauthenticated user if Samba was configured to use the non-default 'username map script' option. (CVE-2007-2447)
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60180
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60180
    title Scientific Linux Security Update : samba on SL5.x, SL4.x, SL3.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SAMBA-3351.NASL
    description Specially crafted MS-RPC packets could overwrite heap memory and therfore could potentially be exploited to execute code. (CVE-2007-2446) Authenticated users could leverage specially crafted MS-RPC packets to pass arguments unfiltered to /bin/sh. (CVE-2007-2447)
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29576
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29576
    title SuSE 10 Security Update : Samba (ZYPP Patch Number 3351)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-104.NASL
    description A number of bugs were discovered in the NDR parsing support in Samba that is used to decode MS-RPC requests. A remote attacker could send a carefully crafted request that would cause a heap overflow, possibly leading to the ability to execute arbitrary code on the server (CVE-2007-2446). A remote authenticated user could trigger a flaw where unescaped user input parameters were being passed as arguments to /bin/sh (CVE-2007-2447). Finally, on Samba 3.0.23d and higher, when Samba translated SID to/from name using the Samba local list of user and group accounts, a logic error in smbd's internal security stack could result in a transition to the root user id rather than the non-root user (CVE-2007-2444). Update : The fix for CVE-2007-2444 broke the behaviour of force group when the forced group is a local Unix group for domain member servers. This update corrects that regression.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 25237
    published 2007-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25237
    title Mandrake Linux Security Advisory : samba (MDKSA-2007:104-1)
  • NASL family Misc.
    NASL id SAMBA_3_0_25.NASL
    description According to its banner, the version of the Samba server installed on the remote host is affected by multiple buffer overflow and remote command injection vulnerabilities, which can be exploited remotely, as well as a local privilege escalation bug.
    last seen 2019-02-21
    modified 2018-07-27
    plugin id 25217
    published 2007-05-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25217
    title Samba < 3.0.25 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SAMBA-3350.NASL
    description Specially crafted MS-RPC packets could overwrite heap memory and therfore could potentially be exploited to execute code (CVE-2007-2446). Authenticated users could leverage specially crafted MS-RPC packets to pass arguments unfiltered to /bin/sh (CVE-2007-2447). A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB protocol operations as root (CVE-2007-2444).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27430
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27430
    title openSUSE 10 Security Update : samba (samba-3350)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_3546A83303EA11DCA51D0019B95D4F14.NASL
    description The Samba Team reports : A bug in the local SID/Name translation routines may potentially result in a user being able to issue SMB/CIFS protocol operations as root. When translating SIDs to/from names using Samba local list of user and group accounts, a logic error in the smbd daemon's internal security stack may result in a transition to the root user id rather than the non-root user. The user is then able to temporarily issue SMB/CIFS protocol operations as the root user. This window of opportunity may allow the attacker to establish additional means of gaining root access to the server. Various bugs in Samba's NDR parsing can allow a user to send specially crafted MS-RPC requests that will overwrite the heap space with user defined data. Unescaped user input parameters are passed as arguments to /bin/sh allowing for remote command execution. This bug was originally reported against the anonymous calls to the SamrChangePassword() MS-RPC function in combination with the 'username map script' smb.conf option (which is not enabled by default). After further investigation by Samba developers, it was determined that the problem was much broader and impacts remote printer and file share management as well. The root cause is passing unfiltered user input provided via MS-RPC calls to /bin/sh when invoking externals scripts defined in smb.conf. However, unlike the 'username map script' vulnerability, the remote file and printer management scripts require an authenticated user session.
    last seen 2019-02-21
    modified 2018-12-19
    plugin id 25260
    published 2007-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25260
    title FreeBSD : samba -- multiple vulnerabilities (3546a833-03ea-11dc-a51d-0019b95d4f14)
oval via4
accepted 2013-04-29T04:01:03.644-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.
family unix
id oval:org.mitre.oval:def:10062
status accepted
submitted 2010-07-09T03:56:16-04:00
title The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.
version 24
packetstorm via4
data source https://packetstormsecurity.com/files/download/86413/usermap_script.rb.txt
id PACKETSTORM:86413
last seen 2016-12-05
published 2010-02-17
reporter jduck
source https://packetstormsecurity.com/files/86413/Samba-username-map-script-Command-Execution.html
title Samba "username map script" Command Execution
redhat via4
advisories
bugzilla
id 239774
title CVE-2007-2447 samba code injection
oval
OR
  • AND
    • comment Red Hat Enterprise Linux 3 is installed
      oval oval:com.redhat.rhsa:tst:20060015001
    • OR
      • AND
        • comment samba is earlier than 0:3.0.9-1.3E.13.2
          oval oval:com.redhat.rhsa:tst:20070354002
        • comment samba is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070060003
      • AND
        • comment samba-client is earlier than 0:3.0.9-1.3E.13.2
          oval oval:com.redhat.rhsa:tst:20070354004
        • comment samba-client is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070060007
      • AND
        • comment samba-common is earlier than 0:3.0.9-1.3E.13.2
          oval oval:com.redhat.rhsa:tst:20070354006
        • comment samba-common is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070060009
      • AND
        • comment samba-swat is earlier than 0:3.0.9-1.3E.13.2
          oval oval:com.redhat.rhsa:tst:20070354008
        • comment samba-swat is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070060005
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhsa:tst:20060016001
    • OR
      • AND
        • comment samba is earlier than 0:3.0.10-1.4E.12.2
          oval oval:com.redhat.rhsa:tst:20070354011
        • comment samba is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070060003
      • AND
        • comment samba-client is earlier than 0:3.0.10-1.4E.12.2
          oval oval:com.redhat.rhsa:tst:20070354013
        • comment samba-client is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070060007
      • AND
        • comment samba-common is earlier than 0:3.0.10-1.4E.12.2
          oval oval:com.redhat.rhsa:tst:20070354014
        • comment samba-common is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070060009
      • AND
        • comment samba-swat is earlier than 0:3.0.10-1.4E.12.2
          oval oval:com.redhat.rhsa:tst:20070354012
        • comment samba-swat is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20070060005
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment samba is earlier than 0:3.0.23c-2.el5.2.0.2
          oval oval:com.redhat.rhsa:tst:20070354016
        • comment samba is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070061003
      • AND
        • comment samba-client is earlier than 0:3.0.23c-2.el5.2.0.2
          oval oval:com.redhat.rhsa:tst:20070354022
        • comment samba-client is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070061009
      • AND
        • comment samba-common is earlier than 0:3.0.23c-2.el5.2.0.2
          oval oval:com.redhat.rhsa:tst:20070354020
        • comment samba-common is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070061005
      • AND
        • comment samba-swat is earlier than 0:3.0.23c-2.el5.2.0.2
          oval oval:com.redhat.rhsa:tst:20070354018
        • comment samba-swat is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070061007
rhsa
id RHSA-2007:0354
released 2007-05-14
severity Critical
title RHSA-2007:0354: samba security update (Critical)
rpms
  • samba-0:3.0.9-1.3E.13.2
  • samba-client-0:3.0.9-1.3E.13.2
  • samba-common-0:3.0.9-1.3E.13.2
  • samba-swat-0:3.0.9-1.3E.13.2
  • samba-0:3.0.10-1.4E.12.2
  • samba-client-0:3.0.10-1.4E.12.2
  • samba-common-0:3.0.10-1.4E.12.2
  • samba-swat-0:3.0.10-1.4E.12.2
  • samba-0:3.0.23c-2.el5.2.0.2
  • samba-client-0:3.0.23c-2.el5.2.0.2
  • samba-common-0:3.0.23c-2.el5.2.0.2
  • samba-swat-0:3.0.23c-2.el5.2.0.2
refmap via4
apple APPLE-SA-2007-07-31
bid
  • 23972
  • 25159
bugtraq
  • 20070513 [SAMBA-SECURITY] CVE-2007-2447: Remote Command Injection Vulnerability
  • 20070515 FLEA-2007-0017-1: samba
cert-vn VU#268336
confirm
debian DSA-1291
fulldisc 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player
gentoo GLSA-200705-15
hp
  • HPSBTU02218
  • HPSBUX02218
  • SSRT071424
idefense 20070514 Samba SAMR Change Password Remote Command Injection Vulnerability
mandriva MDKSA-2007:104
openpkg OpenPKG-SA-2007.012
osvdb 34700
sectrack 1018051
secunia
  • 25232
  • 25241
  • 25246
  • 25251
  • 25255
  • 25256
  • 25257
  • 25259
  • 25270
  • 25289
  • 25567
  • 25675
  • 25772
  • 26083
  • 26235
  • 26909
  • 27706
  • 28292
slackware SSA:2007-134-01
sreason 2700
sunalert
  • 102964
  • 200588
suse
  • SUSE-SA:2007:031
  • SUSE-SR:2007:014
trustix 2007-0017
ubuntu USN-460-1
vupen
  • ADV-2007-1805
  • ADV-2007-2079
  • ADV-2007-2210
  • ADV-2007-2281
  • ADV-2007-2732
  • ADV-2007-3229
  • ADV-2008-0050
Last major update 07-03-2011 - 21:54
Published 14-05-2007 - 17:19
Last modified 16-10-2018 - 12:43
Back to Top