NVD

Id
56269  
Name
CVE-2007-4138  
Description
The Winbind nss_info extension (nsswitch/idmap_ad.c) in idmap_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is set to rfc2307 or sfu, grants all local users the privileges of gid 0 when the (1) RFC2307 or (2) Services for UNIX (SFU) primary group attribute is not defined.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-09-13  
Modified Date
2011-03-07  
Seq
2007-4138  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
286610 56269 CVE-2007-4138 http://docs.info.apple.com/article.html?artnum=307179  View
286611 56269 CVE-2007-4138 oval:org.mitre.oval:def:10375  View
286612 56269 CVE-2007-4138 3135  View
286613 56269 CVE-2007-4138 SSA:2007-255-02  View
286614 56269 CVE-2007-4138 RHSA-2007:1016  View
286615 56269 CVE-2007-4138 RHSA-2007:1017  View
286616 56269 CVE-2007-4138 http://www.samba.org/samba/security/CVE-2007-4138.html  View
286617 56269 CVE-2007-4138 20070911 [SECURITY] Winbind"s rfc2307 & SFU nss_info plugin in Samba 3.0.25[a-c] assigns users a primary gid of 0 by default  View
286618 56269 CVE-2007-4138 25636  View
286619 56269 CVE-2007-4138 1018681  View
286620 56269 CVE-2007-4138 TA07-352A  View
286621 56269 CVE-2007-4138 ADV-2007-3120  View
286622 56269 CVE-2007-4138 samba-smb-privilege-escalation(36560)  View
286623 56269 CVE-2007-4138 https://issues.rpath.com/browse/RPL-1705  View
286624 56269 CVE-2007-4138 FEDORA-2007-2145  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52021 JVNDB-2007-000684 Samba の idmap_ad.so ライブラリにおける権限昇格の脆弱性 Samba の idmap_ad.so ライブラリにおける nss_info 拡張 (nsswitch/idmap_ad.c) には、”winbind nss info” オプションに RFC2307 もしくは SFU が設定されている場合、グループ属性の処理に不備があり権限昇格の脆弱性が存在します。 CVE-2007-4138 27493 CVE-2007-4138 56269 6.9 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000684.html 2007-09-11 2008-01-18 View