Privilege escalation in Samba
CVE-2007-2444
Logic error in the SID/Name translation functionality in smbd in Samba 3.0.23d through 3.0.25pre2 allows local users to gain temporary privileges and execute SMB/CIFS protocol operations via unspecified vectors that cause the daemon to transition to the root user.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.2 (High). Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.008 (54.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 54.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: -0.000
Affected products
- Samba — versions 3.0.23d, 3.0.24, 3.0.25
- Canonical Ubuntu Linux — versions 6.06, 6.10, 7.04
- Debian Linux — versions 4.0, 5.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security.gentoo.org/glsa/glsa-200705-15.xml (vendor-advisory, Third Party Advisory)
- secunia.com/advisories/25289 (Third Party Advisory, third-party-advisory)
- www.vupen.com/english/advisories/2007/1805 (Permissions Required, vdb-entry)
- secunia.com/advisories/25772 (Third Party Advisory, third-party-advisory)
- www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html (vendor-advisory, Third Party Advisory)
- lists.suse.com/archive/suse-security-announce/2007-May/0006.html (vendor-advisory, Mailing List, Third Party Advisory)
- secunia.com/advisories/25270 (Third Party Advisory, third-party-advisory)
- www.securityfocus.com/archive/1/468670/100/0/threaded (mailing-list, VDB Entry, Third Party Advisory)
- www.vupen.com/english/advisories/2007/2281 (Permissions Required, vdb-entry)
- www.vupen.com/english/advisories/2007/2210 (Permissions Required, vdb-entry)
Frequently asked questions
- What is CVE-2007-2444?
- CVE-2007-2444 is a vulnerability in Samba, classified under Improper Privilege Management. Published 2007-05-14.
- Is CVE-2007-2444 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.