Description
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.25-1 | — |
| Debian 13 | samba | 3.0.25-1 | — |
| Debian 12 | samba | 3.0.25-1 | — |
| Debian 5.0 | samba | 3.0.24-6+lenny3 | DTSA-41-1 |
| Debian 4.0 | samba | 3.0.24-6etch2 | DSA-1291-2 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | samba | 3.0.14a-3sarge6 | DSA-1291-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | samba +3 | 3.0.23c-2.el5.2.0.2 | RHSA-2007:0354 |
| RHEL 4 | samba +3 | 3.0.10-1.4E.12.2 | RHSA-2007:0354 |
| RHEL 3 | samba +3 | 3.0.9-1.3E.13.2 | RHSA-2007:0354 |
| RHEL 2 | samba +3 | 2.2.12-1.21as.6 | RHSA-2007:0354 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cifs-utils | 6.13-1.3 | openSUSE-SU-2024:10683-1 |
| openSUSE Tumbleweed | samba | 4.14.6+git.182.2205d5224e3-1.1 | openSUSE-SU-2024:11365-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 5 modules
-
Samba lsa_io_privilege_set Heap Overflow
auxiliary/dos/samba/lsa_addprivs_heap
-
Samba lsa_io_trans_names Heap Overflow
exploit/osx/samba/lsa_transnames_heap
-
Samba lsa_io_trans_names Heap Overflow
auxiliary/dos/samba/lsa_transnames_heap
-
Samba lsa_io_trans_names Heap Overflow
exploit/linux/samba/lsa_transnames_heap
-
Samba lsa_io_trans_names Heap Overflow
exploit/solaris/samba/lsa_transnames_heap
Exploit-DB 4
- Samba 3.0.24 (Linux) - 'lsa_io_trans_names' Heap Overflow (Metasploit) EDB-16859 · remote · Jul 14, 2010 · verified
- Samba 3.0.24 (Solaris) - 'lsa_io_trans_names' Heap Overflow (Metasploit) EDB-16329 · remote · Apr 5, 2010 · verified
- Samba 3.0.10 (OSX) - 'lsa_io_trans_names' Heap Overflow (Metasploit) EDB-16875 · remote · Apr 5, 2010 · verified
- Samba 3.0.21 < 3.0.24 - LSA trans names Heap Overflow (Metasploit) EDB-9950 · remote · May 14, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2007:0354 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1291-2 samba Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-41-1 samba - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11365-1 ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10683-1 cifs-utils-6.13-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-200705-15 vendor-advisory
- 20070515 ZDI-07-032: Samba sec_io_acl Heap Overflow Vulnerability mailing-list
- 25289 third-party-advisory
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
- 20070515 ZDI-07-031: Samba smb_io_notify_option_type_data Heap Overflow Vulnerability mailing-list
- 20070515 ZDI-07-029: Samba lsa_io_privilege_set Heap Overflow Vulnerability mailing-list
- http://www.samba.org/samba/security/CVE-2007-2446.html
- samba-lsaiotransnames-bo(34316) vdb-entry
- http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf
- ADV-2007-2732 vdb-entry
- ADV-2007-1805 vdb-entry
- ADV-2007-3229 vdb-entry
- 25772 third-party-advisory
- HPSBUX02218 vendor-advisory
- OpenPKG-SA-2007.012 vendor-advisory
- 25257 third-party-advisory
- 25391 third-party-advisory
- 24198 vdb-entry
- 20070515 ZDI-07-030: Samba netdfs_io_dfs_EnumInfo_d Heap Overflow Vulnerability mailing-list
- SUSE-SA:2007:031 vendor-advisory
- 25270 third-party-advisory
- 20070515 FLEA-2007-0017-1: samba mailing-list
- APPLE-SA-2007-07-31 vendor-advisory
- samba-secioacl-bo(34314) vdb-entry
- ADV-2007-2281 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-07-033.html
- ADV-2007-2210 vdb-entry
- HPSBTU02218 vendor-advisory
- samba-netdfsiodfsenuminfod-bo(34311) vdb-entry
- 2007-0017 vendor-advisory
- USN-460-1 vendor-advisory
- samba-smbionotifyoptiontypedata-bo(34312) vdb-entry
- 2702 third-party-advisory
- 25567 third-party-advisory
- 34731 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-07-031.html
- 34699 vdb-entry
- 25241 third-party-advisory
- 28292 third-party-advisory
- MDKSA-2007:104 vendor-advisory
- 25256 third-party-advisory
- https://issues.rpath.com/browse/RPL-1366
- 25259 third-party-advisory
- samba-lsaioprivilegeset-bo(34309) vdb-entry
- SSA:2007-134-01 vendor-advisory
- 34732 vdb-entry
- 102964 vendor-advisory
- 20070513 [SAMBA-SECURITY] CVE-2007-2446: Multiple Heap Overflows Allow Remote Code Execution mailing-list
- 1018050 vdb-entry
- 23973 vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-07-030.html
- 26909 third-party-advisory
- ADV-2008-0050 vdb-entry
- 27706 third-party-advisory
- DSA-1291 vendor-advisory
- VU#773720 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=306172
- 25232 third-party-advisory
- 25251 third-party-advisory
- 200588 vendor-advisory