Description
The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | samba | 3.0.26-1 | — |
| Debian 13 | samba | 3.0.26-1 | — |
| Debian 12 | samba | 3.0.26-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | samba +3 | 3.0.25b-1.el5_1.2 | RHSA-2007:1017 |
| RHEL 4 | samba +3 | 3.0.25b-1.el4_6.2 | RHSA-2007:1016 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cifs-utils | 6.13-1.3 | openSUSE-SU-2024:10683-1 |
| openSUSE Tumbleweed | samba | 4.14.6+git.182.2205d5224e3-1.1 | openSUSE-SU-2024:11365-1 |
Advisories 4
- RHSA-2007:1017 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1016 Red Hat Security Advisory: samba security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:11365-1 ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10683-1 cifs-utils-6.13-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.samba.org/samba/security/CVE-2007-4138.html
- RHSA-2007:1016 vendor-advisory
- 25636 vdb-entry
- 20070911 [SECURITY] Winbind's rfc2307 & SFU nss_info plugin in Samba 3.0.25[a-c] assigns users a primary gid of 0 by default mailing-list
- TA07-352A third-party-advisory
- SSA:2007-255-02 vendor-advisory
- 3135 third-party-advisory
- ADV-2007-3120 vdb-entry
- 26764 third-party-advisory
- 26834 third-party-advisory
- 26795 third-party-advisory
- 1018681 vdb-entry
- FEDORA-2007-2145 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307179
- samba-smb-privilege-escalation(36560) vdb-entry
- https://issues.rpath.com/browse/RPL-1705
- oval:org.mitre.oval:def:10375 vdb-entry signature
- 26776 third-party-advisory
- RHSA-2007:1017 vendor-advisory