Every CVE Search/ Get API key

CVE-2007-2447

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to...

6.0 MediumPublic exploitFix available

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

Exploit likelihood

49.8%Down 29.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.0

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

Record
CVE-2007-2447
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

Record
CVE-2007-2447
Updated
2026-11-02
EUVDEUVD-2007-2442 No score

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

Record
EUVD-2007-2442
Updated
2026-11-02
GitHub AdvisoriesGHSA-xxqh-84mj-whcj No score

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to...

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

Record
GHSA-xxqh-84mj-whcj
Updated
2026-11-02
OSV No score

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

Record
CVE-2007-2447
Updated
2026-11-02
OSVDEBIAN-CVE-2007-2447 No score

The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.

Record
DEBIAN-CVE-2007-2447
Updated
2026-11-02
OSVopenSUSE-SU-2024:10683-1 No score

cifs-utils-6.13-1.3 on GA media

These are all security issues fixed in the cifs-utils-6.13-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10683-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11365-1 No score

ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11365-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
samba
Debian:12
 before 3.0.25-1
3.0.25-1
samba
Debian:13
 before 3.0.25-1
3.0.25-1
samba
Debian:14
 before 3.0.25-1
3.0.25-1
samba
Debian:4.0
From an advisory covering 3 CVEs
 before 3.0.24-6etch2, plus listed versions
3.0.24-63.0.24-6etch1
3.0.24-6etch2
samba
Debian:3.1
From an advisory covering 3 CVEs
 before 3.0.14a-3sarge6, plus listed versions
3.0.14a-33.0.14a-3sarge13.0.14a-3sarge23.0.14a-3sarge33.0.14a-3sarge4
3.0.14a-3sarge6
samba
Debian:5.0
From an advisory covering 3 CVEs
 before 3.0.24-6+lenny3
3.0.24-6+lenny3
samba
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-client
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-common
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-swat
Red Hat:enterprise_linux:2.1::as
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
Show 64 moreShow less
Affected packages
PackageAffectedFixed
samba
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-client
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-common
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-swat
Red Hat:enterprise_linux:2.1::aw
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-client
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-common
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-swat
Red Hat:enterprise_linux:2.1::es
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-client
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-common
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba-swat
Red Hat:enterprise_linux:2.1::ws
From an advisory covering 2 CVEs
 before 0:2.2.12-1.21as.6
0:2.2.12-1.21as.6
samba
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-client
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-common
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-debuginfo
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-swat
Red Hat:enterprise_linux:3::as
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-client
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-common
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-debuginfo
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-swat
Red Hat:enterprise_linux:3::desktop
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-client
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-common
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-debuginfo
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-swat
Red Hat:enterprise_linux:3::es
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-client
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-common
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-debuginfo
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba-swat
Red Hat:enterprise_linux:3::ws
From an advisory covering 2 CVEs
 before 0:3.0.9-1.3E.13.2
0:3.0.9-1.3E.13.2
samba
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-client
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-common
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-swat
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-client
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-common
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-swat
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-client
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-common
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-swat
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-client
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-common
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba-swat
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:3.0.10-1.4E.12.2
0:3.0.10-1.4E.12.2
samba
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba-client
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba-common
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba-swat
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba-client
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba-common
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
samba-swat
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.23c-2.el5.2.0.2
0:3.0.23c-2.el5.2.0.2
cifs-utils
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 6.13-1.3
6.13-1.3
samba
openSUSE:Tumbleweed
From an advisory covering 66 CVEs
 before 4.14.6+git.182.2205d5224e3-1.1
4.14.6+git.182.2205d5224e3-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitSamba "username map script" Command Execution2007-05-14
Exploit-DBSamba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit)2010-08-18
PoC in GitHubamriunix/CVE-2007-24472018-08-03
PoC in GitHubUnix13/metasploitable22019-07-05
PoC in GitHubb1fair/smb_usermap2019-09-30
PoC in GitHubJoseBarrios/CVE-2007-24472020-01-20
PoC in GitHub3x1t1um/CVE-2007-24472020-04-22
PoC in GitHubxlcc4096/exploit-CVE-2007-24472020-12-06
PoC in GitHubWildfootW/CVE-2007-2447_Samba_3.0.25rc32020-12-09
PoC in GitHubZiemni/CVE-2007-2447-in-Python2021-02-22
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHub0xKn/CVE-2007-24472021-03-06
PoC in GitHubozuma/CVE-2007-24472021-03-14
PoC in GitHubG01d3nW01f/CVE-2007-24472021-04-16
PoC in GitHubAlien0ne/CVE-2007-24472021-06-30
PoC in GitHub3t4n/samba-3.0.24-CVE-2007-2447-vunerable-2021-07-23
PoC in GitHubxbufu/CVE-2007-24472021-10-03
PoC in GitHubNosferatuvjr/Samba-Usermap-exploit2022-05-10
PoC in GitHubtestaross4/CVE-2007-24472022-05-13
PoC in GitHubb33m0x00/CVE-2007-24472022-07-20
PoC in GitHubHerculesRD/PyUsernameMapScriptRCE2022-08-07
PoC in GitHubAviksaikat/CVE-2007-24472022-10-14
PoC in GitHubh3x0v3rl0rd/CVE-2007-24472022-10-25
PoC in GitHubbdunlap9/CVE-2007-2447_python2022-12-27
PoC in GitHubMikeRega7/CVE-2007-2447-RCE2023-06-15
PoC in GitHubShivamDey/Samba-CVE-2007-2447-Exploit2023-10-21
PoC in GitHubJuantos/cve-2007-24472024-01-28
PoC in GitHubIamLucif3r/CVE-2007-2447-Exploit2024-07-08

History

History
RecordedChangedSources
affected
exploits_more, factsPoC in GitHub
exploits, exploits_more
affected, aliases, exploits, facts, references, titleEUVD, Exploit-DB, GitHub Advisories, Metasploit, OSV, PoC in GitHub
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-2447 is a medium vulnerability (CVSS 6.0) in Samba, published May 14, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 49.8%, the 98th percentile. Fixed in samba 3.0.25-1.

References

Show 132 moreShow less
This page doesn't list everything

The full exploit list has 19 more links.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open