Description
The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharacters involving the (1) SamrChangePassword function, when the "username map script" smb.conf option is enabled, and allows remote authenticated users to execute commands via shell metacharacters involving other MS-RPC functions in the (2) remote printer and (3) file share management.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.25-1 | — |
| Debian 13 | samba | 3.0.25-1 | — |
| Debian 12 | samba | 3.0.25-1 | — |
| Debian 5.0 | samba | 3.0.24-6+lenny3 | DTSA-41-1 |
| Debian 4.0 | samba | 3.0.24-6etch2 | DSA-1291-2 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | samba | 3.0.14a-3sarge6 | DSA-1291-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | samba +3 | 3.0.23c-2.el5.2.0.2 | RHSA-2007:0354 |
| RHEL 4 | samba +3 | 3.0.10-1.4E.12.2 | RHSA-2007:0354 |
| RHEL 3 | samba +3 | 3.0.9-1.3E.13.2 | RHSA-2007:0354 |
| RHEL 2 | samba +3 | 2.2.12-1.21as.6 | RHSA-2007:0354 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cifs-utils | 6.13-1.3 | openSUSE-SU-2024:10683-1 |
| openSUSE Tumbleweed | samba | 4.14.6+git.182.2205d5224e3-1.1 | openSUSE-SU-2024:11365-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Samba "username map script" Command Execution
exploit/multi/samba/usermap_script
Exploit-DB 1
- Samba 3.0.20 < 3.0.25rc3 - 'Username' map script' Command Execution (Metasploit) EDB-16320 · remote · Aug 18, 2010 · verified
GitHub 45 repositories · most starred shown
-
amriunix/CVE-2007-2447 ★ 62 · Aug 3, 2018
CVE-2007-2447 - Samba usermap script
-
h3x0v3rl0rd/CVE-2007-2447 ★ 5 · Oct 25, 2022
Exploit Samba smbd 3.0.20-Debian
-
Unix13/metasploitable2 ★ 5 · Jul 5, 2019
PHP-CGI-REMOTE_CVE-2012-1823, UnrealIRCd, MySQL, PostgreSQL and SSH bruteforce, VSFTPD2.3.4, samba CVE-2007-2447, JAVA RMI Server, distcc daemon, misconfigured NFS files, etc.
-
Alien0ne/CVE-2007-2447 ★ 3 · Jun 30, 2021
CVE-2007-2447 - Samba usermap script
-
Ziemni/CVE-2007-2447-in-Python ★ 3 · Feb 22, 2021
Python implementation of 'Username' map script' RCE Exploit for Samba 3.0.20 < 3.0.25rc3 (CVE-2007-2447).
-
xbufu/CVE-2007-2447 ★ 2 · Oct 3, 2021
Exploit code for CVE-2007-2447 written in Python3.
-
Nosferatuvjr/Samba-Usermap-exploit ★ 1 · May 10, 2022
CVE-2007-2447
-
ozuma/CVE-2007-2447 ★ 1 · Mar 14, 2021
Exploit Samba
-
3x1t1um/CVE-2007-2447 ★ 1 · Apr 22, 2020
-
JoseBarrios/CVE-2007-2447 ★ 1 · Jan 20, 2020
Remote Command Injection Vulnerability (CVE-2007-2447), allows remote attackers to execute arbitrary commands by specifying a Samba username containing shell meta characters.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2007:0354 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1291-2 samba Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-41-1 samba - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11365-1 ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10683-1 cifs-utils-6.13-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-200705-15 vendor-advisory
- 25289 third-party-advisory
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list
- oval:org.mitre.oval:def:10062 vdb-entry signature
- http://www.xerox.com/downloads/usa/en/c/cert_XRX08_001.pdf
- ADV-2007-2732 vdb-entry
- ADV-2007-1805 vdb-entry
- 26083 third-party-advisory
- ADV-2007-3229 vdb-entry
- 25772 third-party-advisory
- HPSBUX02218 vendor-advisory
- 20070513 [SAMBA-SECURITY] CVE-2007-2447: Remote Command Injection Vulnerability mailing-list
- OpenPKG-SA-2007.012 vendor-advisory
- 25257 third-party-advisory
- VU#268336 third-party-advisory
- 23972 vdb-entry
- SUSE-SA:2007:031 vendor-advisory
- 25270 third-party-advisory
- 20070515 FLEA-2007-0017-1: samba mailing-list
- SUSE-SR:2007:014 vendor-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- ADV-2007-2281 vdb-entry
- ADV-2007-2210 vdb-entry
- HPSBTU02218 vendor-advisory
- 2007-0017 vendor-advisory
- USN-460-1 vendor-advisory
- 25567 third-party-advisory
- 25241 third-party-advisory
- 28292 third-party-advisory
- http://www.samba.org/samba/security/CVE-2007-2447.html
- MDKSA-2007:104 vendor-advisory
- 25256 third-party-advisory
- https://issues.rpath.com/browse/RPL-1366
- 25259 third-party-advisory
- SSA:2007-134-01 vendor-advisory
- 34700 vdb-entry
- 102964 vendor-advisory
- 20070514 Samba SAMR Change Password Remote Command Injection Vulnerability third-party-advisory
- 26909 third-party-advisory
- ADV-2008-0050 vdb-entry
- 27706 third-party-advisory
- DSA-1291 vendor-advisory
- 1018051 vdb-entry
- http://docs.info.apple.com/article.html?artnum=306172
- 2700 third-party-advisory
- 25232 third-party-advisory
- 25251 third-party-advisory
- 200588 vendor-advisory
- 25246 third-party-advisory
- 25159 vdb-entry
- 25255 third-party-advisory
- RHSA-2007:0354 vendor-advisory
- 26235 third-party-advisory
- 25675 third-party-advisory
- ADV-2007-2079 vdb-entry