01 Record

CVE-2007-2446

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum

UnratedPUBLISHEDCNA: redhat

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 77.31% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 99.5% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-16.
Red Hat severity: Critical. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2007-05-14 21:00Z19 YR AGO

Last updated

2024-08-07 13:42Z2 YR AGO

Reserved

2007-05-02

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferClass

Data version

5.1

Document digest

2f4ead55f8a77efb8a19a3fc82b2c1702f01668855e9772fa5c687e1c8c82184

05 Affected products

VendorProductVersionsPlatforms

redhatenterprise_linuxNot specified—

sambasambaNot specified—

06 References

security.gentoo.orgGLSA-200705-15http://security.gentoo.org/glsa/glsa-200705-15.xmlvendor-advisoryx_refsource_GENTOO
www.securityfocus.com20070515 ZDI-07-032: Samba sec_io_acl Heap Overflow Vulnerabilityhttp://www.securityfocus.com/archive/1/468672/100/0/threadedmailing-listx_refsource_BUGTRAQ
secunia.com25289http://secunia.com/advisories/25289third-party-advisoryx_refsource_SECUNIA
lists.grok.org.uk20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Playerhttp://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.htmlmailing-listx_refsource_FULLDISC
www.securityfocus.com20070515 ZDI-07-031: Samba smb_io_notify_option_type_data Heap Overflow Vulnerabilityhttp://www.securityfocus.com/archive/1/468673/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.securityfocus.com20070515 ZDI-07-029: Samba lsa_io_privilege_set Heap Overflow Vulnerabilityhttp://www.securityfocus.com/archive/1/468674/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.samba.orghttp://www.samba.org/samba/security/CVE-2007-2446.htmlx_refsource_CONFIRM
exchange.xforce.ibmcloud.comsamba-lsaiotransnames-bo(34316)https://exchange.xforce.ibmcloud.com/vulnerabilities/34316vdb-entryx_refsource_XF
www.xerox.comhttp://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdfx_refsource_CONFIRM
www.vupen.comADV-2007-2732http://www.vupen.com/english/advisories/2007/2732vdb-entryx_refsource_VUPEN
www.vupen.comADV-2007-1805http://www.vupen.com/english/advisories/2007/1805vdb-entryx_refsource_VUPEN
www.vupen.comADV-2007-3229http://www.vupen.com/english/advisories/2007/3229vdb-entryx_refsource_VUPEN
secunia.com25772http://secunia.com/advisories/25772third-party-advisoryx_refsource_SECUNIA
h20000.www2.hp.comHPSBUX02218http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768vendor-advisoryx_refsource_HP
www.openpkg.comOpenPKG-SA-2007.012http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.htmlvendor-advisoryx_refsource_OPENPKG
secunia.com25257http://secunia.com/advisories/25257third-party-advisoryx_refsource_SECUNIA
secunia.com25391http://secunia.com/advisories/25391/third-party-advisoryx_refsource_SECUNIA
www.securityfocus.com24198http://www.securityfocus.com/bid/24198vdb-entryx_refsource_BID
www.securityfocus.com20070515 ZDI-07-030: Samba netdfs_io_dfs_EnumInfo_d Heap Overflow Vulnerabilityhttp://www.securityfocus.com/archive/1/468675/100/0/threadedmailing-listx_refsource_BUGTRAQ
lists.suse.comSUSE-SA:2007:031http://lists.suse.com/archive/suse-security-announce/2007-May/0006.htmlvendor-advisoryx_refsource_SUSE
secunia.com25270http://secunia.com/advisories/25270third-party-advisoryx_refsource_SECUNIA
www.securityfocus.com20070515 FLEA-2007-0017-1: sambahttp://www.securityfocus.com/archive/1/468670/100/0/threadedmailing-listx_refsource_BUGTRAQ
lists.apple.comAPPLE-SA-2007-07-31http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.htmlvendor-advisoryx_refsource_APPLE
exchange.xforce.ibmcloud.comsamba-secioacl-bo(34314)https://exchange.xforce.ibmcloud.com/vulnerabilities/34314vdb-entryx_refsource_XF
www.vupen.comADV-2007-2281http://www.vupen.com/english/advisories/2007/2281vdb-entryx_refsource_VUPEN
www.zerodayinitiative.comhttp://www.zerodayinitiative.com/advisories/ZDI-07-033.htmlx_refsource_MISC
www.vupen.comADV-2007-2210http://www.vupen.com/english/advisories/2007/2210vdb-entryx_refsource_VUPEN
h20000.www2.hp.comHPSBTU02218http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980vendor-advisoryx_refsource_HP
exchange.xforce.ibmcloud.comsamba-netdfsiodfsenuminfod-bo(34311)https://exchange.xforce.ibmcloud.com/vulnerabilities/34311vdb-entryx_refsource_XF
www.trustix.org2007-0017http://www.trustix.org/errata/2007/0017/vendor-advisoryx_refsource_TRUSTIX
www.ubuntu.comUSN-460-1http://www.ubuntu.com/usn/usn-460-1vendor-advisoryx_refsource_UBUNTU
exchange.xforce.ibmcloud.comsamba-smbionotifyoptiontypedata-bo(34312)https://exchange.xforce.ibmcloud.com/vulnerabilities/34312vdb-entryx_refsource_XF
securityreason.com2702http://securityreason.com/securityalert/2702third-party-advisoryx_refsource_SREASON
secunia.com25567http://secunia.com/advisories/25567third-party-advisoryx_refsource_SECUNIA
osvdb.org34731http://osvdb.org/34731vdb-entryx_refsource_OSVDB
www.zerodayinitiative.comhttp://www.zerodayinitiative.com/advisories/ZDI-07-031.htmlx_refsource_MISC
osvdb.org34699http://osvdb.org/34699vdb-entryx_refsource_OSVDB
secunia.com25241http://secunia.com/advisories/25241third-party-advisoryx_refsource_SECUNIA
secunia.com28292http://secunia.com/advisories/28292third-party-advisoryx_refsource_SECUNIA
www.mandriva.comMDKSA-2007:104http://www.mandriva.com/security/advisories?name=MDKSA-2007:104vendor-advisoryx_refsource_MANDRIVA
secunia.com25256http://secunia.com/advisories/25256third-party-advisoryx_refsource_SECUNIA
issues.rpath.comhttps://issues.rpath.com/browse/RPL-1366x_refsource_CONFIRM
secunia.com25259http://secunia.com/advisories/25259third-party-advisoryx_refsource_SECUNIA
exchange.xforce.ibmcloud.comsamba-lsaioprivilegeset-bo(34309)https://exchange.xforce.ibmcloud.com/vulnerabilities/34309vdb-entryx_refsource_XF
slackware.comSSA:2007-134-01http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906vendor-advisoryx_refsource_SLACKWARE
www.osvdb.org34732http://www.osvdb.org/34732vdb-entryx_refsource_OSVDB
sunsolve.sun.com102964http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1vendor-advisoryx_refsource_SUNALERT
www.securityfocus.com20070513 [SAMBA-SECURITY] CVE-2007-2446: Multiple Heap Overflows Allow Remote Code Executionhttp://www.securityfocus.com/archive/1/468542/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.securitytracker.com1018050http://www.securitytracker.com/id?1018050vdb-entryx_refsource_SECTRACK
www.securityfocus.com23973http://www.securityfocus.com/bid/23973vdb-entryx_refsource_BID
www.zerodayinitiative.comhttp://www.zerodayinitiative.com/advisories/ZDI-07-030.htmlx_refsource_MISC
secunia.com26909http://secunia.com/advisories/26909third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2008-0050http://www.vupen.com/english/advisories/2008/0050vdb-entryx_refsource_VUPEN
secunia.com27706http://secunia.com/advisories/27706third-party-advisoryx_refsource_SECUNIA
www.debian.orgDSA-1291http://www.debian.org/security/2007/dsa-1291vendor-advisoryx_refsource_DEBIAN
www.kb.cert.orgVU#773720http://www.kb.cert.org/vuls/id/773720third-party-advisoryx_refsource_CERT-VN
docs.info.apple.comhttp://docs.info.apple.com/article.html?artnum=306172x_refsource_CONFIRM
secunia.com25232http://secunia.com/advisories/25232third-party-advisoryx_refsource_SECUNIA
secunia.com25251http://secunia.com/advisories/25251third-party-advisoryx_refsource_SECUNIA
sunsolve.sun.com200588http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1vendor-advisoryx_refsource_SUNALERT
secunia.com25246http://secunia.com/advisories/25246third-party-advisoryx_refsource_SECUNIA
www.securityfocus.com20070515 ZDI-07-033: Samba lsa_io_trans_names Heap Overflow Vulnerabilityhttp://www.securityfocus.com/archive/1/468680/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.securityfocus.com24197http://www.securityfocus.com/bid/24197vdb-entryx_refsource_BID
osvdb.org34733http://osvdb.org/34733vdb-entryx_refsource_OSVDB
oval.cisecurity.orgoval:org.mitre.oval:def:11415https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415vdb-entrysignaturex_refsource_OVAL
www.securityfocus.com25159http://www.securityfocus.com/bid/25159vdb-entryx_refsource_BID
www.zerodayinitiative.comhttp://www.zerodayinitiative.com/advisories/ZDI-07-032.htmlx_refsource_MISC
secunia.com25255http://secunia.com/advisories/25255third-party-advisoryx_refsource_SECUNIA
www.securityfocus.com24196http://www.securityfocus.com/bid/24196vdb-entryx_refsource_BID
www.redhat.comRHSA-2007:0354http://www.redhat.com/support/errata/RHSA-2007-0354.htmlvendor-advisoryx_refsource_REDHAT
www.securityfocus.com24195http://www.securityfocus.com/bid/24195vdb-entryx_refsource_BID
www.zerodayinitiative.comhttp://www.zerodayinitiative.com/advisories/ZDI-07-029.htmlx_refsource_MISC
secunia.com26235http://secunia.com/advisories/26235third-party-advisoryx_refsource_SECUNIA
secunia.com25675http://secunia.com/advisories/25675third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2007-2079http://www.vupen.com/english/advisories/2007/2079vdb-entryx_refsource_VUPEN

01 Record index

CVE-2007-2446

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2007-2446

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References