$ cve CVE-2007-2446 JSON

CVE-2007-2446 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 77.7% (pctl 100)

Patch early

A public exploit exists.

Description

Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	77.66% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2007-05-14
Last modified	2026-06-16

Affected (1)

Vendor	Product
samba	samba

Public exploits

Source	Title	Date
exploit-db	Samba 3.0.24 (Linux) - 'lsa_io_trans_names' Heap Overflow (Metasploit)	2010-07-14
exploit-db	Samba 3.0.24 (Solaris) - 'lsa_io_trans_names' Heap Overflow (Metasploit)	2010-04-05
exploit-db	Samba 3.0.10 (OSX) - 'lsa_io_trans_names' Heap Overflow (Metasploit)	2010-04-05
exploit-db	Samba 3.0.21 < 3.0.24 - LSA trans names Heap Overflow (Metasploit)	2007-05-14

References

→ the Explorer · watch your stack · NVD