CVE-2007-2446
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3...
10.0 HighPublic exploitFix available
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Exploit likelihood
77.7%Down 15.5 points since Feb 4, 2022
What each source reports
NVD Score used
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
- Record
CVE-2007-2446- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
- Record
CVE-2007-2446- Updated
- 2026-11-02
EUVDEUVD-2007-2441 No score
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
- Record
EUVD-2007-2441- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3hj-j528-h53w No score
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3...
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
- Record
GHSA-h3hj-j528-h53w- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
- Record
CVE-2007-2446- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-2446 No score
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
- Record
DEBIAN-CVE-2007-2446- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10683-1 No score
cifs-utils-6.13-1.3 on GA media
These are all security issues fixed in the cifs-utils-6.13-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10683-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11365-1 No score
ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media
These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11365-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sambaDebian:12 |
before 3.0.25-1 | 3.0.25-1 |
sambaDebian:13 |
before 3.0.25-1 | 3.0.25-1 |
sambaDebian:14 |
before 3.0.25-1 | 3.0.25-1 |
sambaDebian:4.0 From an advisory covering 3 CVEs |
before 3.0.24-6etch2, plus listed versions 3.0.24-63.0.24-6etch1 |
3.0.24-6etch2 |
sambaDebian:3.1 From an advisory covering 3 CVEs |
before 3.0.14a-3sarge6, plus listed versions 3.0.14a-33.0.14a-3sarge13.0.14a-3sarge23.0.14a-3sarge33.0.14a-3sarge4 |
3.0.14a-3sarge6 |
sambaDebian:5.0 From an advisory covering 3 CVEs |
before 3.0.24-6+lenny3 | 3.0.24-6+lenny3 |
sambaRed Hat:enterprise_linux:2.1::as From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-clientRed Hat:enterprise_linux:2.1::as From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-commonRed Hat:enterprise_linux:2.1::as From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-swatRed Hat:enterprise_linux:2.1::as From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
Show 64 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sambaRed Hat:enterprise_linux:2.1::aw From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-clientRed Hat:enterprise_linux:2.1::aw From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-commonRed Hat:enterprise_linux:2.1::aw From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-swatRed Hat:enterprise_linux:2.1::aw From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
sambaRed Hat:enterprise_linux:2.1::es From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-clientRed Hat:enterprise_linux:2.1::es From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-commonRed Hat:enterprise_linux:2.1::es From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-swatRed Hat:enterprise_linux:2.1::es From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
sambaRed Hat:enterprise_linux:2.1::ws From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-clientRed Hat:enterprise_linux:2.1::ws From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-commonRed Hat:enterprise_linux:2.1::ws From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
samba-swatRed Hat:enterprise_linux:2.1::ws From an advisory covering 2 CVEs |
before 0:2.2.12-1.21as.6 | 0:2.2.12-1.21as.6 |
sambaRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-clientRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-commonRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-swatRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
sambaRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-clientRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-commonRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-swatRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
sambaRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-clientRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-commonRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-swatRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
sambaRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-clientRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-commonRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
samba-swatRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:3.0.9-1.3E.13.2 | 0:3.0.9-1.3E.13.2 |
sambaRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-clientRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-commonRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-swatRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
sambaRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-clientRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-commonRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-swatRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
sambaRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-clientRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-commonRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-swatRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
sambaRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-clientRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-commonRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
samba-swatRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:3.0.10-1.4E.12.2 | 0:3.0.10-1.4E.12.2 |
sambaRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
samba-clientRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
samba-commonRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
samba-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
samba-swatRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
sambaRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
samba-clientRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
samba-commonRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
samba-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
samba-swatRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:3.0.23c-2.el5.2.0.2 | 0:3.0.23c-2.el5.2.0.2 |
cifs-utilsopenSUSE:Tumbleweed From an advisory covering 16 CVEs |
before 6.13-1.3 | 6.13-1.3 |
sambaopenSUSE:Tumbleweed From an advisory covering 66 CVEs |
before 4.14.6+git.182.2205d5224e3-1.1 | 4.14.6+git.182.2205d5224e3-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Samba 3.0.21 < 3.0.24 - LSA trans names Heap Overflow (Metasploit) | 2007-05-14 |
| Metasploit | Samba lsa_io_trans_names Heap Overflow | 2007-05-14 |
| Metasploit | Samba lsa_io_trans_names Heap Overflow | 2007-05-14 |
| Metasploit | Samba lsa_io_trans_names Heap Overflow | 2007-05-14 |
| Exploit-DB | Samba 3.0.24 (Solaris) - 'lsa_io_trans_names' Heap Overflow (Metasploit) | 2010-04-05 |
| Exploit-DB | Samba 3.0.10 (OSX) - 'lsa_io_trans_names' Heap Overflow (Metasploit) | 2010-04-05 |
| Exploit-DB | Samba 3.0.24 (Linux) - 'lsa_io_trans_names' Heap Overflow (Metasploit) | 2010-07-14 |
| Metasploit | Samba lsa_io_privilege_set Heap Overflow | |
| Metasploit | Samba lsa_io_trans_names Heap Overflow |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases | EUVD | |
| affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, Metasploit, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-2446 is a high vulnerability (CVSS 10.0) in Samba, published May 14, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 77.7%, the 99th percentile. Fixed in samba 3.0.25-1.
References
security.gentoo.org/glsa/glsa-200705-15.xml
securityfocus.com/archive/1/468672/100/0/threaded
secunia.com/advisories/25289
lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
Show 151 moreShow less
samba.org/samba/security/CVE-2007-2446.html
exchange.xforce.ibmcloud.com/vulnerabilities/34316
xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf
vupen.com/english/advisories/2007/2732
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
openpkg.com/security/advisories/OpenPKG-SA-2007.012.html
lists.suse.com/archive/suse-security-announce/2007-May/0006.html
lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
zerodayinitiative.com/advisories/ZDI-07-033.html
trustix.org/errata/2007/0017
ubuntu.com/usn/usn-460-1
securityreason.com/securityalert/2702
osvdb.org/34731
mandriva.com/security/advisories?name=MDKSA-2007:104
issues.rpath.com/browse/RPL-1366
slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906
osvdb.org/34732
sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1
securitytracker.com/id?1018050
debian.org/security/2007/dsa-1291
kb.cert.org/vuls/id/773720
docs.info.apple.com/article.html?artnum=306172
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415
redhat.com/support/errata/RHSA-2007-0354.html
nvd.nist.gov/vuln/detail/CVE-2007-2446
github.com/advisories/GHSA-h3hj-j528-h53w
security-tracker.debian.org/tracker/CVE-2007-2446
access.redhat.com/errata/RHSA-2007:0354
bugzilla.redhat.com/show_bug.cgi?id=239429
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0354.json
cve.org/CVERecord?id=CVE-2007-2446
suse.com/security/cve/CVE-2006-1059