CVE-2007-2447

Description

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

6.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 72.72% Top 5%

Vendor Advisory gentoo.org Vendor Advisory hp.com Vendor Advisory openpkg.com Vendor Advisory suse.com Vendor Advisory novell.com Vendor Advisory apple.com Vendor Advisory hp.com Vendor Advisory trustix.org Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory slackware.com Vendor Advisory sun.com Vendor Advisory debian.org Vendor Advisory sun.com Vendor Advisory redhat.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory samba.org

Affected: n/a n/a

References

Link	Tags
http://security.gentoo.org/glsa/glsa-200705-15.xml	vendor advisory
http://secunia.com/advisories/25289	third party advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html	mailing list
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10062	vdb entry signature
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf
http://www.vupen.com/english/advisories/2007/2732	vdb entry
http://www.vupen.com/english/advisories/2007/1805	vdb entry
http://secunia.com/advisories/26083	third party advisory
http://www.vupen.com/english/advisories/2007/3229	vdb entry
http://secunia.com/advisories/25772	third party advisory
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768	vendor advisory
http://www.securityfocus.com/archive/1/468565/100/0/threaded	mailing list
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html	vendor advisory
http://secunia.com/advisories/25257	third party advisory vendor advisory
http://www.kb.cert.org/vuls/id/268336	third party advisory us government resource
http://www.securityfocus.com/bid/23972	vdb entry
http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html	vendor advisory
http://secunia.com/advisories/25270	third party advisory vendor advisory
http://www.securityfocus.com/archive/1/468670/100/0/threaded	mailing list
http://www.novell.com/linux/security/advisories/2007_14_sr.html	vendor advisory
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	vendor advisory
http://www.vupen.com/english/advisories/2007/2281	vdb entry
http://www.vupen.com/english/advisories/2007/2210	vdb entry
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980	vendor advisory
http://www.trustix.org/errata/2007/0017/	vendor advisory
http://www.ubuntu.com/usn/usn-460-1	vendor advisory
http://secunia.com/advisories/25567	third party advisory
http://secunia.com/advisories/25241	third party advisory vendor advisory
http://secunia.com/advisories/28292	third party advisory
http://www.samba.org/samba/security/CVE-2007-2447.html	patch vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:104	vendor advisory
http://secunia.com/advisories/25256	third party advisory vendor advisory
https://issues.rpath.com/browse/RPL-1366
http://secunia.com/advisories/25259	third party advisory vendor advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906	vendor advisory
http://www.osvdb.org/34700	vdb entry
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1	vendor advisory
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534	third party advisory
http://secunia.com/advisories/26909	third party advisory
http://www.vupen.com/english/advisories/2008/0050	vdb entry
http://secunia.com/advisories/27706	third party advisory
http://www.debian.org/security/2007/dsa-1291	vendor advisory
http://www.securitytracker.com/id?1018051	vdb entry
http://docs.info.apple.com/article.html?artnum=306172
http://securityreason.com/securityalert/2700	third party advisory
http://secunia.com/advisories/25232	third party advisory vendor advisory
http://secunia.com/advisories/25251	third party advisory vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1	vendor advisory
http://secunia.com/advisories/25246	third party advisory vendor advisory
http://www.securityfocus.com/bid/25159	vdb entry
http://secunia.com/advisories/25255	third party advisory vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0354.html	vendor advisory
http://secunia.com/advisories/26235	third party advisory
http://secunia.com/advisories/25675	third party advisory
http://www.vupen.com/english/advisories/2007/2079	vdb entry

Frequently Asked Questions

What is the severity of CVE-2007-2447?: CVE-2007-2447 has been scored as a medium severity vulnerability.
How to fix CVE-2007-2447?: To fix CVE-2007-2447, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-2447 being actively exploited in the wild?: It is possible that CVE-2007-2447 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~73% probability that this vulnerability will be exploited by malicious actors in the next 30 days.