NVD

CVE-2007-2447 Detail

Modified

This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided.

Description

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: 6.0 MEDIUM

Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:P)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
http://docs.info.apple.com/article.html?artnum=306172
http://docs.info.apple.com/article.html?artnum=306172
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html
http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html
http://secunia.com/advisories/25232	Vendor Advisory
http://secunia.com/advisories/25232	Vendor Advisory
http://secunia.com/advisories/25241	Vendor Advisory
http://secunia.com/advisories/25241	Vendor Advisory
http://secunia.com/advisories/25246	Vendor Advisory
http://secunia.com/advisories/25246	Vendor Advisory
http://secunia.com/advisories/25251	Vendor Advisory
http://secunia.com/advisories/25251	Vendor Advisory
http://secunia.com/advisories/25255	Vendor Advisory
http://secunia.com/advisories/25255	Vendor Advisory
http://secunia.com/advisories/25256	Vendor Advisory
http://secunia.com/advisories/25256	Vendor Advisory
http://secunia.com/advisories/25257	Vendor Advisory
http://secunia.com/advisories/25257	Vendor Advisory
http://secunia.com/advisories/25259	Vendor Advisory
http://secunia.com/advisories/25259	Vendor Advisory
http://secunia.com/advisories/25270	Vendor Advisory
http://secunia.com/advisories/25270	Vendor Advisory
http://secunia.com/advisories/25289
http://secunia.com/advisories/25289
http://secunia.com/advisories/25567
http://secunia.com/advisories/25567
http://secunia.com/advisories/25675
http://secunia.com/advisories/25675
http://secunia.com/advisories/25772
http://secunia.com/advisories/25772
http://secunia.com/advisories/26083
http://secunia.com/advisories/26083
http://secunia.com/advisories/26235
http://secunia.com/advisories/26235
http://secunia.com/advisories/26909
http://secunia.com/advisories/26909
http://secunia.com/advisories/27706
http://secunia.com/advisories/27706
http://secunia.com/advisories/28292
http://secunia.com/advisories/28292
http://security.gentoo.org/glsa/glsa-200705-15.xml
http://security.gentoo.org/glsa/glsa-200705-15.xml
http://securityreason.com/securityalert/2700
http://securityreason.com/securityalert/2700
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1
http://www.debian.org/security/2007/dsa-1291
http://www.debian.org/security/2007/dsa-1291
http://www.kb.cert.org/vuls/id/268336	US Government Resource
http://www.kb.cert.org/vuls/id/268336	US Government Resource
http://www.mandriva.com/security/advisories?name=MDKSA-2007:104
http://www.mandriva.com/security/advisories?name=MDKSA-2007:104
http://www.novell.com/linux/security/advisories/2007_14_sr.html
http://www.novell.com/linux/security/advisories/2007_14_sr.html
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html
http://www.osvdb.org/34700
http://www.osvdb.org/34700
http://www.redhat.com/support/errata/RHSA-2007-0354.html
http://www.redhat.com/support/errata/RHSA-2007-0354.html
http://www.samba.org/samba/security/CVE-2007-2447.html	Patch Vendor Advisory
http://www.samba.org/samba/security/CVE-2007-2447.html	Patch Vendor Advisory
http://www.securityfocus.com/archive/1/468565/100/0/threaded
http://www.securityfocus.com/archive/1/468565/100/0/threaded
http://www.securityfocus.com/archive/1/468670/100/0/threaded
http://www.securityfocus.com/archive/1/468670/100/0/threaded
http://www.securityfocus.com/bid/23972
http://www.securityfocus.com/bid/23972
http://www.securityfocus.com/bid/25159
http://www.securityfocus.com/bid/25159
http://www.securitytracker.com/id?1018051
http://www.securitytracker.com/id?1018051
http://www.trustix.org/errata/2007/0017/
http://www.trustix.org/errata/2007/0017/
http://www.ubuntu.com/usn/usn-460-1
http://www.ubuntu.com/usn/usn-460-1
http://www.vupen.com/english/advisories/2007/1805
http://www.vupen.com/english/advisories/2007/1805
http://www.vupen.com/english/advisories/2007/2079
http://www.vupen.com/english/advisories/2007/2079
http://www.vupen.com/english/advisories/2007/2210
http://www.vupen.com/english/advisories/2007/2210
http://www.vupen.com/english/advisories/2007/2281
http://www.vupen.com/english/advisories/2007/2281
http://www.vupen.com/english/advisories/2007/2732
http://www.vupen.com/english/advisories/2007/2732
http://www.vupen.com/english/advisories/2007/3229
http://www.vupen.com/english/advisories/2007/3229
http://www.vupen.com/english/advisories/2008/0050
http://www.vupen.com/english/advisories/2008/0050
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf
https://issues.rpath.com/browse/RPL-1366
https://issues.rpath.com/browse/RPL-1366
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10062
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10062

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-Other	Other	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

5 change records found show changes

CVE Modified by CVE 11/20/2024 7:30:48 PM

Action	Type	New Value
Added	Reference	http://docs.info.apple.com/article.html?artnum=306172
Added	Reference	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
Added	Reference	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
Added	Reference	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980
Added	Reference	http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534
Added	Reference	http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
Added	Reference	http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
Added	Reference	http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html
Added	Reference	http://secunia.com/advisories/25232
Added	Reference	http://secunia.com/advisories/25241
Added	Reference	http://secunia.com/advisories/25246
Added	Reference	http://secunia.com/advisories/25251
Added	Reference	http://secunia.com/advisories/25255
Added	Reference	http://secunia.com/advisories/25256
Added	Reference	http://secunia.com/advisories/25257
Added	Reference	http://secunia.com/advisories/25259
Added	Reference	http://secunia.com/advisories/25270
Added	Reference	http://secunia.com/advisories/25289
Added	Reference	http://secunia.com/advisories/25567
Added	Reference	http://secunia.com/advisories/25675
Added	Reference	http://secunia.com/advisories/25772
Added	Reference	http://secunia.com/advisories/26083
Added	Reference	http://secunia.com/advisories/26235
Added	Reference	http://secunia.com/advisories/26909
Added	Reference	http://secunia.com/advisories/27706
Added	Reference	http://secunia.com/advisories/28292
Added	Reference	http://security.gentoo.org/glsa/glsa-200705-15.xml
Added	Reference	http://securityreason.com/securityalert/2700
Added	Reference	http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906
Added	Reference	http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1
Added	Reference	http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1
Added	Reference	http://www.debian.org/security/2007/dsa-1291
Added	Reference	http://www.kb.cert.org/vuls/id/268336
Added	Reference	http://www.mandriva.com/security/advisories?name=MDKSA-2007:104
Added	Reference	http://www.novell.com/linux/security/advisories/2007_14_sr.html
Added	Reference	http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html
Added	Reference	http://www.osvdb.org/34700
Added	Reference	http://www.redhat.com/support/errata/RHSA-2007-0354.html
Added	Reference	http://www.samba.org/samba/security/CVE-2007-2447.html
Added	Reference	http://www.securityfocus.com/archive/1/468565/100/0/threaded
Added	Reference	http://www.securityfocus.com/archive/1/468670/100/0/threaded
Added	Reference	http://www.securityfocus.com/bid/23972
Added	Reference	http://www.securityfocus.com/bid/25159
Added	Reference	http://www.securitytracker.com/id?1018051
Added	Reference	http://www.trustix.org/errata/2007/0017/
Added	Reference	http://www.ubuntu.com/usn/usn-460-1
Added	Reference	http://www.vupen.com/english/advisories/2007/1805
Added	Reference	http://www.vupen.com/english/advisories/2007/2079
Added	Reference	http://www.vupen.com/english/advisories/2007/2210
Added	Reference	http://www.vupen.com/english/advisories/2007/2281
Added	Reference	http://www.vupen.com/english/advisories/2007/2732
Added	Reference	http://www.vupen.com/english/advisories/2007/3229
Added	Reference	http://www.vupen.com/english/advisories/2008/0050
Added	Reference	http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf
Added	Reference	https://issues.rpath.com/browse/RPL-1366
Added	Reference	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10062

Quick Info

CVE Dictionary Entry:
CVE-2007-2447
NVD Published Date:
05/14/2007
NVD Last Modified:
11/20/2024
Source:
Red Hat, Inc.

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2007-2447 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

CVE Modified by CVE 11/20/2024 7:30:48 PM

CVE Modified by Red Hat, Inc. 5/13/2024 9:45:01 PM

CVE Modified by Red Hat, Inc. 10/16/2018 12:43:53 PM

CVE Modified by Red Hat, Inc. 10/10/2017 9:32:13 PM

Initial CVE Analysis 5/16/2007 12:46:00 PM

Quick Info