CVE-2007-2447 Command injection in n/a
Remote attackers can execute arbitrary commands on Samba servers via shell metacharacters in MS-RPC functions, particularly when username mapping scripts are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-2447?
CVE-2007-2447 is a medium-severity command injection vulnerability in Samba Samba, published on 14 May 2007. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.
Which versions are affected by CVE-2007-2447?
It affects 1 product.
Products include Samba Samba.
How do I fix CVE-2007-2447?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2007-2447 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-2447 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 45 proofs of concept on GitHub.
Other vulnerabilities in Samba Samba
Sources
Also known as DEBIAN-CVE-2007-2447, GHSA-xxqh-84mj-whcj.