CVE-2007-2447 json
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metachara…
published 2007-05-14 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-2442
- cvss
- 6.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 49.8%
- EPSS 49.8% chance of exploitation in 30 days, percentile 98%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.
Patch / fix
- samba Debian 14, Debian 13, Debian 12 3.0.25-1
debian advisories DEBIAN-CVE-2007-2447
- samba RHEL 2.1 2.2.12-1.21as.6
- samba RHEL 3 3.0.9-1.3E.13.2
- samba RHEL 4 3.0.10-1.4E.12.2
- samba RHEL 5 3.0.23c-2.el5.2.0.2
- samba-swat RHEL 2.1 2.2.12-1.21as.6
- samba-swat RHEL 3 3.0.9-1.3E.13.2
- samba-swat RHEL 4 3.0.10-1.4E.12.2
- samba-swat RHEL 5 3.0.23c-2.el5.2.0.2
red hat advisories RHSA-2007:0354
- cifs-utils openSUSE Tumbleweed 6.13-1.3
- samba openSUSE Tumbleweed 4.14.6+git.182.2205d5224e3-1.1
opensuse advisories openSUSE-SU-2024:10683-1openSUSE-SU-2024:11365-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2007-2447 updated
samba code injection
-
Red Hat Desktop version 3 samba 3.0.9-1.3E.13.2, samba-swat 3.0.9-1.3E.13.2, samba-client 3.0.9-1.3E.13.2, samba-common 3.0.9-1.3E.13.2 Red Hat Enterprise Linux (v. 5 server) samba 3.0.23c-2.el5.2.0.2, samba-swat 3.0.23c-2.el5.2.0.2, samba-client 3.0.23c-2.el5.2.0.2, samba-common 3.0.23c-2.el5.2.0.2 Red Hat Enterprise Linux AS (Advanced Server) version 2.1 samba 2.2.12-1.21as.6, samba-swat 2.2.12-1.21as.6, samba-client 2.2.12-1.21as.6, samba-common 2.2.12-1.21as.6 Red Hat Enterprise Linux AS version 3 samba 3.0.9-1.3E.13.2, samba-swat 3.0.9-1.3E.13.2, samba-client 3.0.9-1.3E.13.2, samba-common 3.0.9-1.3E.13.2 Red Hat Enterprise Linux AS version 4 samba 3.0.10-1.4E.12.2, samba-swat 3.0.10-1.4E.12.2, samba-client 3.0.10-1.4E.12.2, samba-common 3.0.10-1.4E.12.2 Red Hat Enterprise Linux Desktop (v. 5 client) samba 3.0.23c-2.el5.2.0.2, samba-swat 3.0.23c-2.el5.2.0.2, samba-client 3.0.23c-2.el5.2.0.2, samba-common 3.0.23c-2.el5.2.0.2fixed: vendor fix RHSA-2007:0354
+8 more productsfewer
Red Hat Enterprise Linux Desktop version 4 samba 3.0.10-1.4E.12.2, samba-swat 3.0.10-1.4E.12.2, samba-client 3.0.10-1.4E.12.2, samba-common 3.0.10-1.4E.12.2 Red Hat Enterprise Linux ES version 2.1 samba 2.2.12-1.21as.6, samba-swat 2.2.12-1.21as.6, samba-client 2.2.12-1.21as.6, samba-common 2.2.12-1.21as.6 Red Hat Enterprise Linux ES version 3 samba 3.0.9-1.3E.13.2, samba-swat 3.0.9-1.3E.13.2, samba-client 3.0.9-1.3E.13.2, samba-common 3.0.9-1.3E.13.2 Red Hat Enterprise Linux ES version 4 samba 3.0.10-1.4E.12.2, samba-swat 3.0.10-1.4E.12.2, samba-client 3.0.10-1.4E.12.2, samba-common 3.0.10-1.4E.12.2 Red Hat Enterprise Linux WS version 2.1 samba 2.2.12-1.21as.6, samba-swat 2.2.12-1.21as.6, samba-client 2.2.12-1.21as.6, samba-common 2.2.12-1.21as.6 Red Hat Enterprise Linux WS version 3 samba 3.0.9-1.3E.13.2, samba-swat 3.0.9-1.3E.13.2, samba-client 3.0.9-1.3E.13.2, samba-common 3.0.9-1.3E.13.2 Red Hat Enterprise Linux WS version 4 samba 3.0.10-1.4E.12.2, samba-swat 3.0.10-1.4E.12.2, samba-client 3.0.10-1.4E.12.2, samba-common 3.0.10-1.4E.12.2 Red Hat Linux Advanced Workstation 2.1 samba 2.2.12-1.21as.6, samba-swat 2.2.12-1.21as.6, samba-client 2.2.12-1.21as.6, samba-common 2.2.12-1.21as.6
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (Metasploit exploit/multi/samba/usermap_script)
- Published
Exploit prediction
49.76% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/samba/usermap_script Samba "username map script" Command Execution metasploit exploit, excellent rank, 2007-05-14
- EDB-16320 Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit) remote, 2010-08-18
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
References
-
samba.org
/samba/security/CVE-2007-2447.html
patch, vendor-advisory
-
security.gentoo.org
/glsa/glsa-200705-15.xml
vendor-advisory
-
h20000.www2.hp.com
/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
vendor-advisory
-
openpkg.com
/security/advisories/OpenPKG-SA-2007.012.html
vendor-advisory
-
lists.suse.com
/archive/suse-security-announce/2007-May/0006.html
vendor-advisory
-
novell.com
/linux/security/advisories/2007_14_sr.html
vendor-advisory
-
lists.apple.com
/archives/security-announce//2007/Jul/msg00004.html
vendor-advisory
-
h20000.www2.hp.com
/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980
vendor-advisory
-
trustix.org
/errata/2007/0017/
vendor-advisory
-
ubuntu.com
/usn/usn-460-1
vendor-advisory
-
mandriva.com
/security/advisories?name=MDKSA-2007:104
vendor-advisory
-
slackware.com
/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906
vendor-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-26-102964-1
vendor-advisory
-
debian.org
/security/2007/dsa-1291
vendor-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-66-200588-1
vendor-advisory
-
redhat.com
/support/errata/RHSA-2007-0354.html
vendor-advisory
-
secunia.com
/advisories/25257
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/25270
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/25241
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/25256
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/25259
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/25232
vendor-advisory
-
secunia.com
/advisories/25246
vendor-advisory
-
secunia.com
/advisories/25251
vendor-advisory
-
secunia.com
/advisories/25255
vendor-advisory
-
secunia.com
/advisories/25289
third-party-advisory
-
lists.grok.org.uk
/pipermail/full-disclosure/2007-September/065902.html
mailing-list
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10062
vdb-entry, signature
- xerox.com /downloads/usa/en/c/cert_XRX08_001.pdf
-
vupen.com
/english/advisories/2007/2732
vdb-entry
-
vupen.com
/english/advisories/2007/1805
vdb-entry
-
secunia.com
/advisories/26083
third-party-advisory
-
vupen.com
/english/advisories/2007/3229
vdb-entry
-
secunia.com
/advisories/25772
third-party-advisory
-
securityfocus.com
/archive/1/468565/100/0/threaded
mailing-list
-
kb.cert.org
/vuls/id/268336
third-party-advisory, us-government-resource
-
securityfocus.com
/bid/23972
vdb-entry
-
securityfocus.com
/archive/1/468670/100/0/threaded
mailing-list
-
vupen.com
/english/advisories/2007/2281
vdb-entry
-
vupen.com
/english/advisories/2007/2210
vdb-entry
-
secunia.com
/advisories/25567
third-party-advisory
-
secunia.com
/advisories/28292
third-party-advisory
- issues.rpath.com /browse/RPL-1366
-
osvdb.org
/34700
vdb-entry
- docs.info.apple.com /article.html?artnum=306172
- labs.idefense.com /intelligence/vulnerabilities/display.php?id=534
- secunia.com /advisories/25675
- secunia.com /advisories/26235
- secunia.com /advisories/26909
- secunia.com /advisories/27706
- securityreason.com /securityalert/2700
Sources
- CVE List CVE-2007-2447
- NVD CVE-2007-2447
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.