CVE-2007-2447 Affecting samba package, versions <3.0.25-1


Severity

Recommended
high

Based on Debian security rating.

Threat Intelligence

Exploit Maturity
Mature
EPSS
78.6% (99th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN10-SAMBA-357664
  • published14 May 2007
  • disclosed14 May 2007

Introduced: 14 May 2007

CVE-2007-2447  (opens in a new tab)

How to fix?

Upgrade Debian:10 samba to version 3.0.25-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream samba package and not the samba package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

References

CVSS Scores

version 3.1