HIGH
samba heap overflows
Published May 14, 2007
10.0
HIGHCVSS 2.0
EPSS 77.66%
Description
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Affected products
No data.
OR
- 3.0.0
- 3.0.1
- 3.0.2
- 3.0.2a
- 3.0.10
- 3.0.11
- 3.0.12
- 3.0.13
- 3.0.14
- 3.0.14a
- 3.0.15
- 3.0.16
- 3.0.17
- 3.0.18
- 3.0.19
- 3.0.20
- 3.0.20a
- 3.0.20b
- 3.0.21
- 3.0.21a
- 3.0.21b
- 3.0.21c
- 3.0.22
- 3.0.23
- 3.0.23a
- 3.0.23b
- 3.0.23c
- 3.0.23d
- 3.0.24
- 3.0.25
- 3.0.25
- 3.0.25
- 3.0.25
- 3.0.25
No data.
Red Hat Enterprise Linux 2.1
samba-0:2.2.12-1.21as.6
Fixed · RHSA-2007:0354
Red Hat Enterprise Linux 3
samba-0:3.0.9-1.3E.13.2
Fixed · RHSA-2007:0354
Red Hat Enterprise Linux 4
samba-0:3.0.10-1.4E.12.2
Fixed · RHSA-2007:0354
Red Hat Enterprise Linux 5
samba-0:3.0.23c-2.el5.2.0.2
Fixed · RHSA-2007:0354
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 2.1 | samba-0:2.2.12-1.21as.6 | Fixed | RHSA-2007:0354 |
| Red Hat Enterprise Linux 3 | samba-0:3.0.9-1.3E.13.2 | Fixed | RHSA-2007:0354 |
| Red Hat Enterprise Linux 4 | samba-0:3.0.10-1.4E.12.2 | Fixed | RHSA-2007:0354 |
| Red Hat Enterprise Linux 5 | samba-0:3.0.23c-2.el5.2.0.2 | Fixed | RHSA-2007:0354 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
10.0 HIGH NVD
AV:N/AC:L/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
77.66% 0.77656
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.77656
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (33 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 77.66% (0.77656) | 99.55th | v5 (v2026.06.15) |
| Jun 15, 2026 | 77.66% (0.77656) | 99.50th | v5 (v2026.06.15) |
| Jun 7, 2026 | 90.13% (0.90126) | 99.60th | v4 (v2025.03.14) |
| Nov 30, 2025 | 88.88% (0.88876) | 99.49th | v4 (v2025.03.14) |
| Nov 11, 2025 | 77.70% (0.77703) | 98.94th | v4 (v2025.03.14) |
| Oct 22, 2025 | 76.55% (0.76553) | 98.88th | v4 (v2025.03.14) |
| Oct 19, 2025 | 81.78% (0.81781) | 99.14th | v4 (v2025.03.14) |
| Aug 11, 2025 | 78.83% (0.78833) | 99.00th | v4 (v2025.03.14) |
| Jul 26, 2025 | 79.90% (0.79897) | 99.04th | v4 (v2025.03.14) |
| Jul 16, 2025 | 76.89% (0.76891) | 98.90th | v4 (v2025.03.14) |
| Jun 20, 2025 | 79.79% (0.79794) | 99.03th | v4 (v2025.03.14) |
| May 15, 2025 | 81.54% (0.81538) | 99.11th | v4 (v2025.03.14) |
| Mar 30, 2025 | 79.31% (0.79314) | 99.02th | v4 (v2025.03.14) |
| Mar 29, 2025 | 82.52% (0.82516) | 99.03th | v4 (v2025.03.14) |
| Mar 19, 2025 | 78.44% (0.78439) | 98.97th | v4 (v2025.03.14) |
| Mar 17, 2025 | 79.84% (0.79837) | 99.05th | v4 (v2025.03.14) |
| Dec 17, 2024 | 87.17% (0.87169) | 98.88th | v3 (v2023.03.01) |
| Dec 12, 2024 | 96.48% (0.96477) | 99.65th | v3 (v2023.03.01) |
| Jul 9, 2024 | 96.38% (0.96382) | 99.58th | v3 (v2023.03.01) |
| Jun 1, 2024 | 96.29% (0.96294) | 99.54th | v3 (v2023.03.01) |
| Apr 24, 2024 | 96.41% (0.96415) | 99.55th | v3 (v2023.03.01) |
| Mar 17, 2024 | 96.49% (0.96493) | 99.56th | v3 (v2023.03.01) |
| Feb 8, 2024 | 96.71% (0.96707) | 99.61th | v3 (v2023.03.01) |
| Nov 24, 2023 | 96.44% (0.96436) | 99.45th | v3 (v2023.03.01) |
| Oct 16, 2023 | 96.41% (0.96406) | 99.41th | v3 (v2023.03.01) |
| Sep 8, 2023 | 96.24% (0.96237) | 99.32th | v3 (v2023.03.01) |
| Aug 3, 2023 | 97.13% (0.97129) | 99.68th | v3 (v2023.03.01) |
| May 20, 2023 | 97.22% (0.97219) | 99.71th | v3 (v2023.03.01) |
| Apr 14, 2023 | 97.26% (0.97257) | 99.71th | v3 (v2023.03.01) |
| Mar 10, 2023 | 97.30% (0.97299) | 99.73th | v3 (v2023.03.01) |
| Mar 7, 2023 | 97.29% (0.97287) | 99.72th | v3 (v2023.03.01) |
| Mar 6, 2023 | 93.18% (0.93181) | 99.92th | v2 (v2022.01.01) |
| Feb 4, 2022 | 93.18% (0.93181) | 99.92th | v2 (v2022.01.01) |
Weaknesses (1)
References (79)
- http://docs.info.apple.com/article.html?artnum=306172 x_refsource_CONFIRM
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768 vendor-advisoryx_refsource_HP
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980 vendor-advisoryx_refsource_HP
- http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html vendor-advisoryx_refsource_APPLE
- http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html mailing-listx_refsource_FULLDISC
- http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html vendor-advisoryx_refsource_SUSE
- http://osvdb.org/34699 vdb-entryx_refsource_OSVDB
- http://osvdb.org/34731 vdb-entryx_refsource_OSVDB
- http://osvdb.org/34733 vdb-entryx_refsource_OSVDB
- http://secunia.com/advisories/25232 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25241 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25246 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25251 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25255 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25256 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25257 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25259 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25270 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/25289 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/25391/ third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/25567 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/25675 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/25772 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/26235 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/26909 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/27706 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/28292 third-party-advisoryx_refsource_SECUNIA
- http://security.gentoo.org/glsa/glsa-200705-15.xml vendor-advisoryx_refsource_GENTOO
- http://securityreason.com/securityalert/2702 third-party-advisoryx_refsource_SREASON
- http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906 vendor-advisoryx_refsource_SLACKWARE
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1 vendor-advisoryx_refsource_SUNALERT
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1 vendor-advisoryx_refsource_SUNALERT
- http://www.debian.org/security/2007/dsa-1291 vendor-advisoryx_refsource_DEBIAN
- http://www.kb.cert.org/vuls/id/773720 third-party-advisoryx_refsource_CERT-VNUS Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:104 vendor-advisoryx_refsource_MANDRIVA
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html vendor-advisoryx_refsource_OPENPKG
- http://www.osvdb.org/34732 vdb-entryx_refsource_OSVDB
- http://www.redhat.com/support/errata/RHSA-2007-0354.html vendor-advisoryx_refsource_REDHATVendor Advisory
- http://www.samba.org/samba/security/CVE-2007-2446.html x_refsource_CONFIRMPatchVendor Advisory
- http://www.securityfocus.com/archive/1/468542/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/468670/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/468672/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/468673/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/468674/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/468675/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/468680/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/23973 vdb-entryx_refsource_BID
- http://www.securityfocus.com/bid/24195 vdb-entryx_refsource_BID
- http://www.securityfocus.com/bid/24196 vdb-entryx_refsource_BID
- http://www.securityfocus.com/bid/24197 vdb-entryx_refsource_BID
- http://www.securityfocus.com/bid/24198 vdb-entryx_refsource_BID
- http://www.securityfocus.com/bid/25159 vdb-entryx_refsource_BID
- http://www.securitytracker.com/id?1018050 vdb-entryx_refsource_SECTRACK
- http://www.trustix.org/errata/2007/0017/ vendor-advisoryx_refsource_TRUSTIX
- http://www.ubuntu.com/usn/usn-460-1 vendor-advisoryx_refsource_UBUNTU
- http://www.vupen.com/english/advisories/2007/1805 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2007/2079 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2007/2210 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2007/2281 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2007/2732 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2007/3229 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/0050 vdb-entryx_refsource_VUPEN
- http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf x_refsource_CONFIRM
- http://www.zerodayinitiative.com/advisories/ZDI-07-029.html x_refsource_MISC
- http://www.zerodayinitiative.com/advisories/ZDI-07-030.html x_refsource_MISC
- http://www.zerodayinitiative.com/advisories/ZDI-07-031.html x_refsource_MISC
- http://www.zerodayinitiative.com/advisories/ZDI-07-032.html x_refsource_MISC
- http://www.zerodayinitiative.com/advisories/ZDI-07-033.html x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2007-2446 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=239429 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34309 vdb-entryx_refsource_XF
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34311 vdb-entryx_refsource_XF
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34312 vdb-entryx_refsource_XF
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34314 vdb-entryx_refsource_XF
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34316 vdb-entryx_refsource_XF
- https://issues.rpath.com/browse/RPL-1366 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2007-2446
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415 vdb-entrysignaturex_refsource_OVAL
- https://www.cve.org/CVERecord?id=CVE-2007-2446
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published May 14, 2007
Updated Aug 7, 2024
Reserved May 2, 2007
Link CVE-2007-2446
CISA Vulnrichment
Updated n/a