PT-2007-1090 · Samba · Samba

Andrew Hogue + 1 · Published 2007-05-14 · Updated 2024-06-15 · CVE-2007-2444

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Samba versions 3.0.23d through 3.0.25pre2 Samba version 3.0.24-r2 and earlier

Description: The issue is related to multiple vulnerabilities in the Samba package, which can be exploited remotely. These vulnerabilities may lead to a breach of confidentiality, integrity, and availability of protected information. A logic error in the SID/Name translation functionality in smbd allows local users to gain temporary privileges and execute SMB/CIFS protocol operations.

Recommendations: For Samba versions 3.0.23d through 3.0.25pre2, update to a version later than 3.0.25pre2 to resolve the issue. For Samba version 3.0.24-r2 and earlier, update to a version later than 3.0.24-r2. As a temporary workaround, consider restricting access to the smbd daemon to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2015-09575

CVE-2007-2444

DSA-1291-2

DTSA-41-1

OPENSUSE-SU-2024:10683-1

OPENSUSE-SU-2024:11365-1

Affected Products

Samba

References · 113

• https://osv.dev/vulnerability/openSUSE-SU-2024:11365-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200705-15.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2444 · Security Note
• http://debian.org/security/2007/dsa-1291 · Vendor Advisory
• http://ubuntu.com/usn/usn-460-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09575 · Security Note
• https://osv.dev/vulnerability/CVE-2007-2444 · Vendor Advisory
• http://openpkg.com/security/advisories/OpenPKG-SA-2007.012.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10683-1 · Vendor Advisory
• http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-2444 · Vendor Advisory
• http://samba.org/samba/security/CVE-2007-2444.html · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980 · Vendor Advisory